{
  "@id": "urn:uuid:c09829d3-d854-4e12-ae8e-aec17aa41c8e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 45,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T11:23:00.028670+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:12:13.552310+00:00",
      "status_notes": "Vulnerability CVE-2017-15095 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.9.9 is NOT vulnerable to CVE-2017-15095. The vulnerability (unsafe deserialization of gadget-chain classes via polymorphic typing) was fixed in upstream version 2.9.9 before TuxCare onboarded it. The fix includes a comprehensive blacklist in SubTypeValidator.java that blocks all classes from CVE-2017-15095 (#1737): java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and others. Additionally, the implementation includes sophisticated pattern-based defenses for Spring and C3P0 classes that go beyond simple string matching.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-15095"
      },
      "impact_statement": "Target jackson-databind 2.9.9 is NOT vulnerable to CVE-2017-15095. The vulnerability (unsafe deserialization of gadget-chain classes via polymorphic typing) was fixed in upstream version 2.9.9 before TuxCare onboarded it. The fix includes a comprehensive blacklist in SubTypeValidator.java that blocks all classes from CVE-2017-15095 (#1737): java.util.logging.FileHandler, java.rmi.server.UnicastRemoteObject, and others. Additionally, the implementation includes sophisticated pattern-based defenses for Spring and C3P0 classes that go beyond simple string matching.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4; >= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2), NVD (>= 2.0.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.10; = 2.9.0; = 2.9.0-prerelease1; = 2.9.0-prerelease2; = 2.9.0-prerelease3; = 2.9.0-prerelease4), cve.org (< 2.8.10; < 2.9.1), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.10)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:47:06.064229+00:00",
      "status_notes": "Vulnerability CVE-2017-17485 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2017-17485 addresses incomplete deserialization blacklist fixes in jackson-databind, specifically when Spring libraries are in the classpath. The target repository (jackson-databind 2.9.9-tuxcare.2) is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability in version 2.9.4 (December 2017), which is included in the 2.9.9 release that TuxCare onboarded. The fixes (issues #1737 and #1855) added blacklist entries and pattern-based validation for Spring framework classes (AbstractPointcutAdvisor, AbstractApplicationContext), C3P0 DataSource classes, and other dangerous types in SubTypeValidator. All fix commits were authored by upstream developers (tatu.saloranta@iki.fi, andrew.tolbert@datastax.com) and are ancestors of TuxCare's initial onboarding commit (c809a21b).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-17485"
      },
      "impact_statement": "CVE-2017-17485 addresses incomplete deserialization blacklist fixes in jackson-databind, specifically when Spring libraries are in the classpath. The target repository (jackson-databind 2.9.9-tuxcare.2) is NOT AFFECTED because the upstream vendor (FasterXML) already fixed this vulnerability in version 2.9.4 (December 2017), which is included in the 2.9.9 release that TuxCare onboarded. The fixes (issues #1737 and #1855) added blacklist entries and pattern-based validation for Spring framework classes (AbstractPointcutAdvisor, AbstractApplicationContext), C3P0 DataSource classes, and other dangerous types in SubTypeValidator. All fix commits were authored by upstream developers (tatu.saloranta@iki.fi, andrew.tolbert@datastax.com) and are ancestors of TuxCare's initial onboarding commit (c809a21b).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.4; >= 2.8.0, < 2.8.11; < 2.7.9.2), NVD (< 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:31:06.545047+00:00",
      "status_notes": "Vulnerability CVE-2017-7525 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target jackson-databind 2.9.9-tuxcare.2 is not affected by CVE-2017-7525. The vulnerability, which allowed arbitrary code execution through deserialization of dangerous classes like TemplatesImpl when default typing is enabled, was fixed in the upstream release 2.9.9 that TuxCare onboarded. The fix is present in SubTypeValidator.java which maintains a blocklist of dangerous classes (including both variants of TemplatesImpl on lines 42-43) and prevents their deserialization during bean creation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-7525"
      },
      "impact_statement": "The target jackson-databind 2.9.9-tuxcare.2 is not affected by CVE-2017-7525. The vulnerability, which allowed arbitrary code execution through deserialization of dangerous classes like TemplatesImpl when default typing is enabled, was fixed in the upstream release 2.9.9 that TuxCare onboarded. The fix is present in SubTypeValidator.java which maintains a blocklist of dangerous classes (including both variants of TemplatesImpl on lines 42-43) and prevents their deserialization during bean creation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9), NVD (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9; = 2.9.0-prerelease1; = 2.9.0-prerelease2), cve.org (< 2.6.7.1; < 2.7.9.1; < 2.8.9), Snyk (< 2.6.7.1; >= 2.7.0, < 2.7.9.1; >= 2.8.0, < 2.8.9)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:22:33.360201+00:00",
      "status_notes": "Vulnerability CVE-2018-11307 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.9.9-tuxcare.2 is not affected by CVE-2018-11307. The vulnerability involves Jackson default typing with an iBatis XPathParser gadget class allowing content exfiltration. The fix (blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator) was already present in upstream version 2.9.9, which TuxCare onboarded. The CVE affected versions 2.0.0-2.9.5 and was fixed in 2.9.6+. Since 2.9.9 > 2.9.6, the target inherited the upstream fix during onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11307"
      },
      "impact_statement": "Target jackson-databind 2.9.9-tuxcare.2 is not affected by CVE-2018-11307. The vulnerability involves Jackson default typing with an iBatis XPathParser gadget class allowing content exfiltration. The fix (blacklisting org.apache.ibatis.parsing.XPathParser in SubTypeValidator) was already present in upstream version 2.9.9, which TuxCare onboarded. The CVE affected versions 2.0.0-2.9.5 and was fixed in 2.9.6+. Since 2.9.9 > 2.9.6, the target inherited the upstream fix during onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.0.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2018-12022 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target jackson-databind 2.9.9 is NOT affected by CVE-2018-12022. The vulnerability was fixed upstream in version 2.9.6, and the target version 2.9.9 already includes this fix. The SubTypeValidator blacklist contains all three gadget classes mentioned in the CVE (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet), preventing their polymorphic deserialization. The fix was authored by the upstream vendor (Tatu Saloranta) and shipped in the 2.9.9 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12022"
      },
      "impact_statement": "Target jackson-databind 2.9.9 is NOT affected by CVE-2018-12022. The vulnerability was fixed upstream in version 2.9.6, and the target version 2.9.9 already includes this fix. The SubTypeValidator blacklist contains all three gadget classes mentioned in the CVE (jodd.db.connection.DataSourceConnectionProvider, oracle.jdbc.connector.OracleManagedConnectionFactory, oracle.jdbc.rowset.OracleJDBCRowSet), preventing their polymorphic deserialization. The fix was authored by the upstream vendor (Tatu Saloranta) and shipped in the 2.9.9 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:22:58.856963+00:00",
      "status_notes": "Vulnerability CVE-2018-12023 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-12023 affects jackson-databind when Default Typing is enabled and Oracle JDBC classes are deserialized, enabling arbitrary code execution via JNDI/LDAP lookup. The fix blacklists oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java. The target repository (jackson-databind 2.9.9-tuxcare.2) already contains this fix at SubTypeValidator.java:68-69, introduced by upstream author Tatu Saloranta in commit 28badf7ef60 (2018-06-07). This commit is an ancestor of the first TuxCare onboarding commit (c809a21b28b), confirming the fix shipped in the upstream 2.9.9 release. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-12023"
      },
      "impact_statement": "CVE-2018-12023 affects jackson-databind when Default Typing is enabled and Oracle JDBC classes are deserialized, enabling arbitrary code execution via JNDI/LDAP lookup. The fix blacklists oracle.jdbc.connector.OracleManagedConnectionFactory and oracle.jdbc.rowset.OracleJDBCRowSet in SubTypeValidator.java. The target repository (jackson-databind 2.9.9-tuxcare.2) already contains this fix at SubTypeValidator.java:68-69, introduced by upstream author Tatu Saloranta in commit 28badf7ef60 (2018-06-07). This commit is an ancestor of the first TuxCare onboarding commit (c809a21b28b), confirming the fix shipped in the upstream 2.9.9 release. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), NVD (>= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.4; >= 2.8.0, < 2.8.11.2; >= 2.9.0, < 2.9.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:00:11.067776+00:00",
      "status_notes": "Vulnerability CVE-2018-14718 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. The target repository (jackson-databind 2.9.9-tuxcare.2) is NOT affected by CVE-2018-14718. The vulnerability requires the absence of \"org.slf4j.ext.EventData\" from the polymorphic deserialization blocklist, but this class is present in the target's SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES set (line 72). The fix was committed to upstream jackson-databind on 2018-08-16 (commit 87d29af25e) and shipped in version 2.9.7 (released 2018-09-18). The target version 2.9.9 (released 2019-05-15) inherently includes this upstream fix, which TuxCare later onboarded. The vulnerable pattern (missing blocklist entry) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14718"
      },
      "impact_statement": "The target repository (jackson-databind 2.9.9-tuxcare.2) is NOT affected by CVE-2018-14718. The vulnerability requires the absence of \"org.slf4j.ext.EventData\" from the polymorphic deserialization blocklist, but this class is present in the target's SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES set (line 72). The fix was committed to upstream jackson-databind on 2018-08-16 (commit 87d29af25e) and shipped in version 2.9.7 (released 2018-09-18). The target version 2.9.9 (released 2019-05-15) inherently includes this upstream fix, which TuxCare later onboarded. The vulnerable pattern (missing blocklist entry) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:02:59.383624+00:00",
      "status_notes": "Vulnerability CVE-2018-14719 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14719 is NOT present in jackson-databind 2.9.9. The vulnerability involves polymorphic deserialization of dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that can lead to arbitrary code execution. The fix adds these four classes to a blocklist that prevents their deserialization. This fix was already present in the upstream jackson-databind 2.9.9 release (commit 0899726ec34 by upstream maintainer Tatu Saloranta on 2018-08-16), before TuxCare onboarded version 2.9.9. The target contains the fix at SubTypeValidator.java:72-75, and the SubTypeValidator is properly invoked during bean deserializer creation (BeanDeserializerFactory.java:135), blocking instantiation of these dangerous classes before deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14719"
      },
      "impact_statement": "CVE-2018-14719 is NOT present in jackson-databind 2.9.9. The vulnerability involves polymorphic deserialization of dangerous classes (org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) that can lead to arbitrary code execution. The fix adds these four classes to a blocklist that prevents their deserialization. This fix was already present in the upstream jackson-databind 2.9.9 release (commit 0899726ec34 by upstream maintainer Tatu Saloranta on 2018-08-16), before TuxCare onboarded version 2.9.9. The target contains the fix at SubTypeValidator.java:72-75, and the SubTypeValidator is properly invoked during bean deserializer creation (BeanDeserializerFactory.java:135), blocking instantiation of these dangerous classes before deserialization occurs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.0.0, < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:09:29.528523+00:00",
      "status_notes": "Vulnerability CVE-2018-14720 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-14720 does not affect jackson-databind 2.9.9-tuxcare.2. The CVE affects versions \"before 2.9.7\" and describes XXE attacks via unblocked JDK classes in polymorphic deserialization. The fix (blocking four specific classes: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was authored by upstream maintainer Tatu Saloranta in commit 87d29af and shipped in the upstream 2.9.9 release. TuxCare onboarded the already-fixed 2.9.9 version. The blacklist is present in SubTypeValidator.java lines 71-75 and is enforced via _validateSubType in BeanDeserializerFactory.java line 135 before any deserialization occurs. The vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14720"
      },
      "impact_statement": "CVE-2018-14720 does not affect jackson-databind 2.9.9-tuxcare.2. The CVE affects versions \"before 2.9.7\" and describes XXE attacks via unblocked JDK classes in polymorphic deserialization. The fix (blocking four specific classes: org.slf4j.ext.EventData, flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor, com.sun.deploy.security.ruleset.DRSHelper, and org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) was authored by upstream maintainer Tatu Saloranta in commit 87d29af and shipped in the upstream 2.9.9 release. TuxCare onboarded the already-fixed 2.9.9 version. The blacklist is present in SubTypeValidator.java lines 71-75 and is enforced via _validateSubType in BeanDeserializerFactory.java line 135 before any deserialization occurs. The vulnerable code pattern was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T14:40:31.077655+00:00",
      "status_notes": "Vulnerability CVE-2018-14721 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Target version 2.9.9 is not affected by CVE-2018-14721. The vulnerability concerns polymorphic deserialization of the axis2-jaxws class (org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) which could enable SSRF attacks. The upstream fix (commit 87d29af25e) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java and was already present in upstream version 2.9.9 before TuxCare onboarded it. The CVE affects versions before 2.9.7, so 2.9.9 shipped with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-14721"
      },
      "impact_statement": "Target version 2.9.9 is not affected by CVE-2018-14721. The vulnerability concerns polymorphic deserialization of the axis2-jaxws class (org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl) which could enable SSRF attacks. The upstream fix (commit 87d29af25e) added this class to the DEFAULT_NO_DESER_CLASS_NAMES blocklist in SubTypeValidator.java and was already present in upstream version 2.9.9 before TuxCare onboarded it. The CVE affects versions before 2.9.7, so 2.9.9 shipped with the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.7; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, < 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7; = 2.7.0-rc1; = 2.7.0-rc2; = 2.7.0-rc3; = 2.8.0-rc1; = 2.8.0-rc2; = 2.9.0-pr1; = 2.9.0-pr2; = 2.9.0-pr3; = 2.9.0-pr4), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:53:41.382779+00:00",
      "status_notes": "Vulnerability CVE-2018-19360 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo, allowing polymorphic deserialization attacks. The target repository (version 2.9.9-tuxcare.2) contains the upstream fix from commit 72cd4025a2 authored by Tatu Saloranta on Nov 19, 2018. This fix was already present in the upstream 2.9.9 release that TuxCare onboarded. The blocklist entry at SubTypeValidator.java:81 blocks the malicious class from deserialization, preventing arbitrary code execution. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19360"
      },
      "impact_statement": "CVE-2018-19360 affects jackson-databind versions before 2.9.8 due to missing blocklist entry for org.apache.axis2.transport.jms.JMSOutTransportInfo, allowing polymorphic deserialization attacks. The target repository (version 2.9.9-tuxcare.2) contains the upstream fix from commit 72cd4025a2 authored by Tatu Saloranta on Nov 19, 2018. This fix was already present in the upstream 2.9.9 release that TuxCare onboarded. The blocklist entry at SubTypeValidator.java:81 blocks the malicious class from deserialization, preventing arbitrary code execution. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:59:33.966848+00:00",
      "status_notes": "Vulnerability CVE-2018-19361 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) in polymorphic deserialization. The target repository is version 2.9.9, which already includes the upstream fix from commit 72cd4025a2 (Fix #2186) authored by Tatu Saloranta. The openjpa classes are present in the SubTypeValidator blocklist at lines 79-80, preventing their deserialization. This fix was part of the upstream 2.9.9 release that TuxCare onboarded, not a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19361"
      },
      "impact_statement": "CVE-2018-19361 affects jackson-databind versions before 2.9.8 due to missing blocklist entries for openjpa classes (org.apache.openjpa.ee.RegistryManagedRuntime and org.apache.openjpa.ee.JNDIManagedRuntime) in polymorphic deserialization. The target repository is version 2.9.9, which already includes the upstream fix from commit 72cd4025a2 (Fix #2186) authored by Tatu Saloranta. The openjpa classes are present in the SubTypeValidator blocklist at lines 79-80, preventing their deserialization. This fix was part of the upstream 2.9.9 release that TuxCare onboarded, not a separate TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.7.0, < 2.7.9.5; >= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T15:27:13.005239+00:00",
      "status_notes": "Vulnerability CVE-2018-19362 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-19362 affects jackson-databind versions before 2.9.8. The target is version 2.9.9-tuxcare.2, which includes the upstream fix that blocks org.jboss.util.propertyeditor.DocumentEditor from polymorphic deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.9 release, prior to TuxCare onboarding. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-19362"
      },
      "impact_statement": "CVE-2018-19362 affects jackson-databind versions before 2.9.8. The target is version 2.9.9-tuxcare.2, which includes the upstream fix that blocks org.jboss.util.propertyeditor.DocumentEditor from polymorphic deserialization. The fix was authored by upstream maintainer Tatu Saloranta and shipped in the upstream 2.9.9 release, prior to TuxCare onboarding. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.8; >= 2.8.0, < 2.8.11.3; >= 2.7.0, < 2.7.9.5; >= 2.0.0, < 2.6.7.3), NVD (>= 2.6.0, <= 2.6.7.2; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8), Snyk (< 2.6.7.3; >= 2.7.0, < 2.7.9.5; >= 2.8.0, < 2.8.11.3; >= 2.9.0, < 2.9.8)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2018-5968 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-5968 does not affect jackson-databind 2.9.9. The vulnerability involved two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass jackson-databind's deserialization blacklist to achieve remote code execution. The upstream vendor (FasterXML) fixed this in version 2.9.4 by adding both classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. The target version 2.9.9 includes this upstream fix (commit 038b471e2e by tatu.saloranta@iki.fi, dated 2018-01-21), which was already present in the upstream release before TuxCare onboarded it. The blacklist is properly enforced during bean deserialization, preventing these gadget classes from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-5968"
      },
      "impact_statement": "CVE-2018-5968 does not affect jackson-databind 2.9.9. The vulnerability involved two gadget classes (org.hibernate.jmx.StatisticsService and org.apache.ibatis.datasource.jndi.JndiDataSourceFactory) that could bypass jackson-databind's deserialization blacklist to achieve remote code execution. The upstream vendor (FasterXML) fixed this in version 2.9.4 by adding both classes to the DEFAULT_NO_DESER_CLASS_NAMES blacklist in SubTypeValidator.java. The target version 2.9.9 includes this upstream fix (commit 038b471e2e by tatu.saloranta@iki.fi, dated 2018-01-21), which was already present in the upstream release before TuxCare onboarded it. The blacklist is properly enforced during bean deserialization, preventing these gadget classes from being instantiated.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4; < 2.7.9.5), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.2; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.4), Snyk (< 2.8.11; >= 2.9.0, < 2.9.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T13:58:31.761827+00:00",
      "status_notes": "Vulnerability CVE-2018-7489 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2018-7489 affects jackson-databind versions before 2.9.5. The target is version 2.9.9-tuxcare.2, which already contained the upstream fix when TuxCare onboarded it. The fix (commit 6799f8f10c by tatu.saloranta@iki.fi) was released in upstream version 2.9.5 and blocks deserialization of c3p0 DataSource classes via SubTypeValidator. The vulnerable code pattern is not present in the target because the upstream vendor's fix was already included in the 2.9.9 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-7489"
      },
      "impact_statement": "CVE-2018-7489 affects jackson-databind versions before 2.9.5. The target is version 2.9.9-tuxcare.2, which already contained the upstream fix when TuxCare onboarded it. The fix (commit 6799f8f10c by tatu.saloranta@iki.fi) was released in upstream version 2.9.5 and blocks deserialization of c3p0 DataSource classes via SubTypeValidator. The vulnerable code pattern is not present in the target because the upstream vendor's fix was already included in the 2.9.9 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5; >= 2.7.0, < 2.7.9.3; < 2.6.7.5), NVD (< 2.7.9.3; >= 2.8.0, < 2.8.11.1; >= 2.9.0, < 2.9.5), Snyk (< 2.6.7.5; >= 2.7.0, < 2.8.11.1; >= 2.9.0, < 2.9.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T16:36:34.248507+00:00",
      "status_notes": "Vulnerability CVE-2019-12086 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target is version 2.9.9-tuxcare.2, which contains the upstream fix that shipped in 2.9.9. The fix adds 'com.mysql.cj.jdbc.admin.MiniAdmin' to the SubTypeValidator blacklist (SubTypeValidator.java:84), preventing polymorphic deserialization of this gadget class. Commit dda513bd72 by upstream author tatu.saloranta@iki.fi was already part of the 2.9.9 release that TuxCare onboarded (commit c809a21b28). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-12086"
      },
      "impact_statement": "CVE-2019-12086 affects jackson-databind versions before 2.9.9. The target is version 2.9.9-tuxcare.2, which contains the upstream fix that shipped in 2.9.9. The fix adds 'com.mysql.cj.jdbc.admin.MiniAdmin' to the SubTypeValidator blacklist (SubTypeValidator.java:84), preventing polymorphic deserialization of this gadget class. Commit dda513bd72 by upstream author tatu.saloranta@iki.fi was already part of the 2.9.9 release that TuxCare onboarded (commit c809a21b28). The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; >= 2.0.0, < 2.6.7.3), NVD (>= 2.0.0, < 2.6.7.3; >= 2.7.0, < 2.7.9.6; >= 2.8.0, < 2.8.11.4; >= 2.9.0, < 2.9.9), Snyk (>= 2.9.0, < 2.9.9; >= 2.8.0, < 2.8.11.4; >= 2.7.0, < 2.7.9.6; < 2.6.7.3)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:21:00.566724+00:00",
      "status_notes": "Vulnerability CVE-2019-12384 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-12384"
      },
      "action_statement": "Vulnerability CVE-2019-12384 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:21:00.566724+00:00",
      "status_notes": "Vulnerability CVE-2019-12814 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-12814"
      },
      "action_statement": "Vulnerability CVE-2019-12814 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:21:00.566724+00:00",
      "status_notes": "Vulnerability CVE-2019-14379 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-14379"
      },
      "action_statement": "Vulnerability CVE-2019-14379 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2019-14439 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-14439"
      },
      "action_statement": "Vulnerability CVE-2019-14439 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T11:23:00.028670+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "action_statement": "Vulnerability CVE-2019-14540 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:20:28.658025+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "action_statement": "Vulnerability CVE-2019-14892 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "action_statement": "Vulnerability CVE-2019-14893 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:20:28.658025+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "action_statement": "Vulnerability CVE-2019-16335 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:49:04.829388+00:00",
      "status_notes": "Vulnerability CVE-2019-16942 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2019-16942"
      },
      "action_statement": "Vulnerability CVE-2019-16942 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-16943"
      },
      "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:20:28.658025+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "action_statement": "Vulnerability CVE-2019-17267 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2019-17531 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2019-17531"
      },
      "action_statement": "Vulnerability CVE-2019-17531 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:48:24.450783+00:00",
      "status_notes": "Vulnerability CVE-2019-20330 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2019-20330"
      },
      "action_statement": "Vulnerability CVE-2019-20330 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:48:56.134278+00:00",
      "status_notes": "Vulnerability CVE-2020-10650 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-10650"
      },
      "action_statement": "Vulnerability CVE-2020-10650 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T11:23:00.028670+00:00",
      "status_notes": "Vulnerability CVE-2020-10672 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-10672"
      },
      "action_statement": "Vulnerability CVE-2020-10672 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:49:26.359489+00:00",
      "status_notes": "Vulnerability CVE-2020-10673 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-10673"
      },
      "action_statement": "Vulnerability CVE-2020-10673 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-10968"
      },
      "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:49:47.585578+00:00",
      "status_notes": "Vulnerability CVE-2020-10969 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-10969"
      },
      "action_statement": "Vulnerability CVE-2020-10969 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:48:24.450783+00:00",
      "status_notes": "Vulnerability CVE-2020-11111 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-11111"
      },
      "action_statement": "Vulnerability CVE-2020-11111 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:49:26.359489+00:00",
      "status_notes": "Vulnerability CVE-2020-11112 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-11112"
      },
      "action_statement": "Vulnerability CVE-2020-11112 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:48:56.134278+00:00",
      "status_notes": "Vulnerability CVE-2020-11113 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-11113"
      },
      "action_statement": "Vulnerability CVE-2020-11113 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:49:26.359489+00:00",
      "status_notes": "Vulnerability CVE-2020-11619 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-11619"
      },
      "action_statement": "Vulnerability CVE-2020-11619 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T11:23:00.028670+00:00",
      "status_notes": "Vulnerability CVE-2020-11620 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2020-11620"
      },
      "action_statement": "Vulnerability CVE-2020-11620 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2020-14060 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-14060"
      },
      "action_statement": "Vulnerability CVE-2020-14060 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2020-14061 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-14061"
      },
      "action_statement": "Vulnerability CVE-2020-14061 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2020-14062 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-14062"
      },
      "action_statement": "Vulnerability CVE-2020-14062 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:49:39.147056+00:00",
      "status_notes": "Vulnerability CVE-2020-14195 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-14195"
      },
      "action_statement": "Vulnerability CVE-2020-14195 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-24616"
      },
      "action_statement": "Vulnerability CVE-2020-24616 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:19:00.112893+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-24750"
      },
      "action_statement": "Vulnerability CVE-2020-24750 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-25649"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      },
      "action_statement": "Vulnerability CVE-2020-35491 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      },
      "action_statement": "Vulnerability CVE-2020-35728 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:48:24.450783+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      },
      "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:21:00.566724+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      },
      "action_statement": "Vulnerability CVE-2020-36182 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:20:28.658025+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      },
      "action_statement": "Vulnerability CVE-2020-36183 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      },
      "action_statement": "Vulnerability CVE-2020-36187 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      },
      "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:20:28.658025+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "action_statement": "Vulnerability CVE-2020-36189 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:48:58.446786+00:00",
      "status_notes": "Vulnerability CVE-2020-8840 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-8840"
      },
      "action_statement": "Vulnerability CVE-2020-8840 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:48:00.456510+00:00",
      "status_notes": "Vulnerability CVE-2020-9546 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-9546"
      },
      "action_statement": "Vulnerability CVE-2020-9546 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:49:26.359489+00:00",
      "status_notes": "Vulnerability CVE-2020-9547 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2020-9547"
      },
      "action_statement": "Vulnerability CVE-2020-9547 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-9548"
      },
      "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T11:23:00.028670+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2021-20190"
      },
      "action_statement": "Vulnerability CVE-2021-20190 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:13:36.432303+00:00",
      "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-46877"
      },
      "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "action_statement": "Vulnerability CVE-2022-42003 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:52:00.040792+00:00",
      "status_notes": "Vulnerability CVE-2026-110879 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-110879"
      },
      "action_statement": "Vulnerability CVE-2026-110879 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      },
      "action_statement": "Vulnerability CVE-2026-50193 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:18:00.107592+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:12:47.728703+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      },
      "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T12:50:01.408979+00:00",
      "status_notes": "Vulnerability CVE-2026-54516 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-54516"
      },
      "action_statement": "Vulnerability CVE-2026-54516 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:02:19.900071+00:00",
      "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54517"
      },
      "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T02:07:28.476186+00:00",
      "status_notes": "Vulnerability CVE-2026-54518 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.9 is not affected by CVE-2026-54518. The vulnerable feature (support for @JsonUnwrapped on creator parameters) was introduced in version 2.19.0 (April 2025), approximately 6 years after this version was released (May 2019). In 2.9.9, attempting to use @JsonUnwrapped on creator parameters explicitly throws InvalidDefinitionException. The vulnerable method processUnwrappedCreatorPrope...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54518"
      },
      "impact_statement": "not_affected \u2014 Version 2.9.9 is not affected by CVE-2026-54518. The vulnerable feature (support for @JsonUnwrapped on creator parameters) was introduced in version 2.19.0 (April 2025), approximately 6 years after this version was released (May 2019). In 2.9.9, attempting to use @JsonUnwrapped on creator parameters explicitly throws InvalidDefinitionException. The vulnerable method processUnwrappedCreatorPrope..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T01:44:00.124016+00:00",
      "status_notes": "Vulnerability CVE-2026-59888 does not affect version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Version 2.9.9 is not affected by CVE-2026-59888. The vulnerability is specific to Java Records (introduced in Java 16), but version 2.9.9 targets Java 1.7 and contains no Record support code. The vulnerable code pattern\u2014where Record components marked @JsonIgnore are renamed by PropertyNamingStrategy before their ignore status propagates to the renamed key\u2014cannot exist in 2.9.9's architecture. F...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59888"
      },
      "impact_statement": "not_affected \u2014 Version 2.9.9 is not affected by CVE-2026-59888. The vulnerability is specific to Java Records (introduced in Java 16), but version 2.9.9 targets Java 1.7 and contains no Record support code. The vulnerable code pattern\u2014where Record components marked @JsonIgnore are renamed by PropertyNamingStrategy before their ignore status propagates to the renamed key\u2014cannot exist in 2.9.9's architecture. F..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:21:00.566724+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T09:21:00.566724+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:31.273423+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T09:20:00.152294+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind, and is fixed in 2.9.9-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:19:00.944798+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.9-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-wrr7-33fx-rcvj"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}