{ "@id": "urn:uuid:1e468875-dab3-44e8-afc9-eca8b2d071bd", "role": "Document Creator", "author": "https://tuxcare.com", "version": 18, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T07:57:13.458746+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2017-15095 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-15095" }, "action_statement": "Vulnerability CVE-2017-15095 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2017-17485 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-17485" }, "action_statement": "Vulnerability CVE-2017-17485 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2017-7525 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2017-7525" }, "action_statement": "Vulnerability CVE-2017-7525 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2018-11307 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-11307" }, "action_statement": "Vulnerability CVE-2018-11307 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2018-12022 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-12022" }, "action_statement": "Vulnerability CVE-2018-12022 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2018-12023 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-12023" }, "action_statement": "Vulnerability CVE-2018-12023 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2018-14718 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14718" }, "action_statement": "Vulnerability CVE-2018-14718 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2018-14719 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14719" }, "action_statement": "Vulnerability CVE-2018-14719 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2018-14720 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14720" }, "action_statement": "Vulnerability CVE-2018-14720 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2018-14721 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-14721" }, "action_statement": "Vulnerability CVE-2018-14721 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2018-19360 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19360" }, "action_statement": "Vulnerability CVE-2018-19360 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2018-19361 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19361" }, "action_statement": "Vulnerability CVE-2018-19361 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2018-19362 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-19362" }, "action_statement": "Vulnerability CVE-2018-19362 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2018-5968 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-5968" }, "action_statement": "Vulnerability CVE-2018-5968 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2018-7489 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2018-7489" }, "action_statement": "Vulnerability CVE-2018-7489 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2019-12086 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12086" }, "action_statement": "Vulnerability CVE-2019-12086 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2019-12384 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12384" }, "action_statement": "Vulnerability CVE-2019-12384 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2019-12814 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-12814" }, "action_statement": "Vulnerability CVE-2019-12814 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2019-14379 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14379" }, "action_statement": "Vulnerability CVE-2019-14379 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2019-14439 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-14439" }, "action_statement": "Vulnerability CVE-2019-14439 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2019-14540 concerns a polymorphic deserialization gadget vulnerability in jackson-databind related to com.zaxxer.hikari.HikariConfig and HikariDataSource classes. The target version 2.9.10.8 already contains the upstream vendor fix: both HikariConfig and HikariDataSource are present in the deserialization blocklist (SubTypeValidator.java lines 105, 107). These entries were added by upstream maintainer Tatu Saloranta in commits d4983c740 (Aug 2019) and 73c1c2cc7 (Sep 2019), which predated the 2.9.10.8 release (Jan 2021). The fix was already present when TuxCare onboarded this version. Verdict: not_affected because the vulnerable pattern (missing blocklist entries) is not present in the shipped version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14540" }, "impact_statement": "CVE-2019-14540 concerns a polymorphic deserialization gadget vulnerability in jackson-databind related to com.zaxxer.hikari.HikariConfig and HikariDataSource classes. The target version 2.9.10.8 already contains the upstream vendor fix: both HikariConfig and HikariDataSource are present in the deserialization blocklist (SubTypeValidator.java lines 105, 107). These entries were added by upstream maintainer Tatu Saloranta in commits d4983c740 (Aug 2019) and 73c1c2cc7 (Sep 2019), which predated the 2.9.10.8 release (Jan 2021). The fix was already present when TuxCare onboarded this version. Verdict: not_affected because the vulnerable pattern (missing blocklist entries) is not present in the shipped version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind, HEAD at the TuxCare 'onboard/2.9.10.8' merge (authoritative version 2.9.10.8, SHA 6cb03eb88). CVE-2019-14892 is a polymorphic-deserialization gadget CVE: with default/polymorphic typing enabled, an attacker supplies a JSON payload naming commons-configuration 1/2 JNDIConfiguration as the concrete type, triggering an attacker-controlled JNDI lookup and RCE. The upstream fix (databind#2462, commit 41b7f9b90) adds both class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES deny-list so validateSubType rejects them. The target's SubTypeValidator.java:112-114 contains those exact two entries verbatim. git blame shows the lines were authored and committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in the original 2019 upstream fix commit 41b7f9b90 \u2014 an ancestor of HEAD reached through the normal upstream 2.7->2.8->2.9 merge chain. No TuxCare/CloudLinux backport MR for this CVE exists; the fix was already present in the stock upstream 2.9.10.x line (fixed in 2.9.10) and merely imported by the onboard merge. Enforcement is wired: BeanDeserializerFactory:135 -> _validateSubType:919 -> SubTypeValidator.validateSubType -> deny-list contains(full) -> reportBadTypeDefinition throws. This is the upstream-fix-already-in-shipped-version case: not_affected / code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14892" }, "impact_statement": "not_affected \u2014 Target is jackson-databind, HEAD at the TuxCare 'onboard/2.9.10.8' merge (authoritative version 2.9.10.8, SHA 6cb03eb88). CVE-2019-14892 is a polymorphic-deserialization gadget CVE: with default/polymorphic typing enabled, an attacker supplies a JSON payload naming commons-configuration 1/2 JNDIConfiguration as the concrete type, triggering an attacker-controlled JNDI lookup and RCE. The upstream fix (databind#2462, commit 41b7f9b90) adds both class names to SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES deny-list so validateSubType rejects them. The target's SubTypeValidator.java:112-114 contains those exact two entries verbatim. git blame shows the lines were authored and committed by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) in the original 2019 upstream fix commit 41b7f9b90 \u2014 an ancestor of HEAD reached through the normal upstream 2.7->2.8->2.9 merge chain. No TuxCare/CloudLinux backport MR for this CVE exists; the fix was already present in the stock upstream 2.9.10.x line (fixed in 2.9.10) and merely imported by the onboard merge. Enforcement is wired: BeanDeserializerFactory:135 -> _validateSubType:919 -> SubTypeValidator.validateSubType -> deny-list contains(full) -> reportBadTypeDefinition throws. This is the upstream-fix-already-in-shipped-version case: not_affected / code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is jackson-databind 2.9.10.8 (TuxCare ELS onboarding of the upstream micro-patch release). CVE-2019-14893 is the xalan JNDI gadget deserialization RCE, fixed by the vendor by adding class name \"org.apache.xalan.lib.sql.JNDIConnectionPool\" (databind#2469) to the SubTypeValidator deny-list. The target ALREADY CONTAINS this exact fix at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:117, plus the internal xalan2 variant \"com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool\" (#2704) at line 119. git blame shows line 117 was introduced by commit 998efd708284778f29d83d7962a9bd935c228317 \u2014 the exact vendor patch SHA given as input \u2014 authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19. The SHA is byte-identical to the upstream commit (a backport would carry a new SHA), the fix is an ancestor of the onboard merge's upstream first-parent, and it ships in the upstream jackson-databind-2.9.10 tag. This is an UPSTREAM/vendor fix present in the shipped baseline, not a TuxCare backport \u2014 verdict not_affected (justification code_not_present). The vulnerable pre-fix pattern (missing deny-list entry) does not exist in HEAD. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-14893" }, "impact_statement": "not_affected \u2014 Target is jackson-databind 2.9.10.8 (TuxCare ELS onboarding of the upstream micro-patch release). CVE-2019-14893 is the xalan JNDI gadget deserialization RCE, fixed by the vendor by adding class name \"org.apache.xalan.lib.sql.JNDIConnectionPool\" (databind#2469) to the SubTypeValidator deny-list. The target ALREADY CONTAINS this exact fix at src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:117, plus the internal xalan2 variant \"com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool\" (#2704) at line 119. git blame shows line 117 was introduced by commit 998efd708284778f29d83d7962a9bd935c228317 \u2014 the exact vendor patch SHA given as input \u2014 authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19. The SHA is byte-identical to the upstream commit (a backport would carry a new SHA), the fix is an ancestor of the onboard merge's upstream first-parent, and it ships in the upstream jackson-databind-2.9.10 tag. This is an UPSTREAM/vendor fix present in the shipped baseline, not a TuxCare backport \u2014 verdict not_affected (justification code_not_present). The vulnerable pre-fix pattern (missing deny-list entry) does not exist in HEAD. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 Target is FasterXML jackson-databind (pom version 2.9.10.20210106 / authoritative 2.9.10.8), an ELS-maintained tree. CVE-2019-16335 is a polymorphic-typing deserialization gadget CVE for com.zaxxer.hikari.HikariDataSource, fixed upstream (issue #2449) by adding that class to jackson-databind's deserialization deny-list in SubTypeValidator. The fix is ALREADY PRESENT in HEAD: src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:107 contains s.add(\"com.zaxxer.hikari.HikariDataSource\"); with the exact upstream comment \"[databind#2449]: and sub-class thereof\" at line 106. This entry is wired into validateSubType() which, before any subtype is instantiated, matches the incoming class name against _cfgIllegalClassNames (= DEFAULT_NO_DESER_CLASS_NAMES) and, on a hit, throws \"Illegal type (...) to deserialize: prevented for security reasons\" (lines 269, 302-303). git blame attributes line 107 to the exact upstream fix commit 73c1c2cc (Tatu Saloranta, tatu.saloranta@iki.fi, 2019-09-12) \u2014 NOT a TuxCare backport; no CloudLinux/TuxCare author ever touched this file. The shipped version (2.9.10.x) is at/after 2.9.10 where the fix first landed, so the vulnerable pattern (missing deny-list entry) is not present. Verdict: not_affected (upstream vendor fix baked in), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-16335" }, "impact_statement": "not_affected \u2014 Target is FasterXML jackson-databind (pom version 2.9.10.20210106 / authoritative 2.9.10.8), an ELS-maintained tree. CVE-2019-16335 is a polymorphic-typing deserialization gadget CVE for com.zaxxer.hikari.HikariDataSource, fixed upstream (issue #2449) by adding that class to jackson-databind's deserialization deny-list in SubTypeValidator. The fix is ALREADY PRESENT in HEAD: src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java:107 contains s.add(\"com.zaxxer.hikari.HikariDataSource\"); with the exact upstream comment \"[databind#2449]: and sub-class thereof\" at line 106. This entry is wired into validateSubType() which, before any subtype is instantiated, matches the incoming class name against _cfgIllegalClassNames (= DEFAULT_NO_DESER_CLASS_NAMES) and, on a hit, throws \"Illegal type (...) to deserialize: prevented for security reasons\" (lines 269, 302-303). git blame attributes line 107 to the exact upstream fix commit 73c1c2cc (Tatu Saloranta, tatu.saloranta@iki.fi, 2019-09-12) \u2014 NOT a TuxCare backport; no CloudLinux/TuxCare author ever touched this file. The shipped version (2.9.10.x) is at/after 2.9.10 where the fix first landed, so the vulnerable pattern (missing deny-list entry) is not present. Verdict: not_affected (upstream vendor fix baked in), justification code_not_present. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2019-16942 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16942" }, "action_statement": "Vulnerability CVE-2019-16942 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2019-16943 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-16943" }, "action_statement": "Vulnerability CVE-2019-16943 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2019-17267 is a jackson-databind polymorphic-typing (default-typing) gadget vulnerability: with default typing enabled, an attacker-controlled JSON type identifier naming net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup can be deserialized, triggering a JNDI/JTA lookup that leads to RCE/SSRF. The vendor fix (commit 191a4cdf87) adds this class name to jackson-databind's deserialization deny-list in SubTypeValidator.java.\n\nThe target (jackson-databind 2.9.10.8, SHA 6cb03eb8) ALREADY CONTAINS the fix: SubTypeValidator.java line 99 has `s.add(\"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\");`, under the `[databind#2387], [databind#2460]: EHCache` comment (lines 97-99). git blame attributes line 99 to the exact upstream patch commit 191a4cdf87, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19. This fix shipped in upstream 2.9.10 (CVE is \"before 2.9.10\"; target 2.9.10.8 is later in the same line) and is an ancestor of the onboarded upstream baseline. The deny-list is enforced via BeanDeserializerFactory._validateSubType -> SubTypeValidator.validateSubType, which rejects the class with \"Illegal type ... prevented for security reasons\".\n\nVerdict: not_affected \u2014 upstream/vendor-authored fix already present in the shipped version (the vulnerable missing-deny-list-entry pattern is not present in HEAD). Not already_fixed: the fix is upstream-authored, not a CloudLinux/TuxCare backport. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2019-17267" }, "impact_statement": "not_affected \u2014 CVE-2019-17267 is a jackson-databind polymorphic-typing (default-typing) gadget vulnerability: with default typing enabled, an attacker-controlled JSON type identifier naming net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup can be deserialized, triggering a JNDI/JTA lookup that leads to RCE/SSRF. The vendor fix (commit 191a4cdf87) adds this class name to jackson-databind's deserialization deny-list in SubTypeValidator.java.\n\nThe target (jackson-databind 2.9.10.8, SHA 6cb03eb8) ALREADY CONTAINS the fix: SubTypeValidator.java line 99 has `s.add(\"net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup\");`, under the `[databind#2387], [databind#2460]: EHCache` comment (lines 97-99). git blame attributes line 99 to the exact upstream patch commit 191a4cdf87, authored by upstream maintainer Tatu Saloranta (tatu.saloranta@iki.fi) on 2019-09-19. This fix shipped in upstream 2.9.10 (CVE is \"before 2.9.10\"; target 2.9.10.8 is later in the same line) and is an ancestor of the onboarded upstream baseline. The deny-list is enforced via BeanDeserializerFactory._validateSubType -> SubTypeValidator.validateSubType, which rejects the class with \"Illegal type ... prevented for security reasons\".\n\nVerdict: not_affected \u2014 upstream/vendor-authored fix already present in the shipped version (the vulnerable missing-deny-list-entry pattern is not present in HEAD). Not already_fixed: the fix is upstream-authored, not a CloudLinux/TuxCare backport. [VC re-run with claude-opus-4-8, prod pin d46bd7a, 2026-09-21; the earlier Sonnet run was parked by the author-verification gate after crediting a TuxCare backport for an upstream fix]" }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2019-17531 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-17531" }, "action_statement": "Vulnerability CVE-2019-17531 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2019-20330 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2019-20330" }, "action_statement": "Vulnerability CVE-2019-20330 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:28:44.006786+00:00", "status_notes": "Vulnerability CVE-2020-10650 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10650" }, "action_statement": "Vulnerability CVE-2020-10650 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:42:05.316703+00:00", "status_notes": "Vulnerability CVE-2020-10672 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10672" }, "action_statement": "Vulnerability CVE-2020-10672 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2020-10673 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10673" }, "action_statement": "Vulnerability CVE-2020-10673 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:41:43.216873+00:00", "status_notes": "Vulnerability CVE-2020-10968 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10968" }, "action_statement": "Vulnerability CVE-2020-10968 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:38:21.395921+00:00", "status_notes": "Vulnerability CVE-2020-10969 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-10969" }, "action_statement": "Vulnerability CVE-2020-10969 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:40:44.036745+00:00", "status_notes": "Vulnerability CVE-2020-11111 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11111" }, "action_statement": "Vulnerability CVE-2020-11111 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:38:21.395921+00:00", "status_notes": "Vulnerability CVE-2020-11112 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11112" }, "action_statement": "Vulnerability CVE-2020-11112 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:43:01.874718+00:00", "status_notes": "Vulnerability CVE-2020-11113 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11113" }, "action_statement": "Vulnerability CVE-2020-11113 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:40:44.036745+00:00", "status_notes": "Vulnerability CVE-2020-11619 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11619" }, "action_statement": "Vulnerability CVE-2020-11619 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:43:28.017435+00:00", "status_notes": "Vulnerability CVE-2020-11620 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-11620" }, "action_statement": "Vulnerability CVE-2020-11620 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:41:19.548572+00:00", "status_notes": "Vulnerability CVE-2020-14060 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14060" }, "action_statement": "Vulnerability CVE-2020-14060 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:38:21.395921+00:00", "status_notes": "Vulnerability CVE-2020-14061 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14061" }, "action_statement": "Vulnerability CVE-2020-14061 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:42:45.805756+00:00", "status_notes": "Vulnerability CVE-2020-14062 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14062" }, "action_statement": "Vulnerability CVE-2020-14062 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:39:12.873936+00:00", "status_notes": "Vulnerability CVE-2020-14195 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-14195" }, "action_statement": "Vulnerability CVE-2020-14195 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2020-24616 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24616" }, "action_statement": "Vulnerability CVE-2020-24616 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2020-24750 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-24750" }, "action_statement": "Vulnerability CVE-2020-24750 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2020-25649 does not affect version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-25649 (XXE vulnerability in DOMDeserializer) was fixed by upstream FasterXML in version 2.9.10.7 (released 02-Dec-2020). The target repository is at version 2.9.10.8 (released 06-Jan-2021), which contains the complete upstream fix. The fix adds two XML parser security features: disallow-doctype-decl=true and load-external-dtd=false, preventing XXE attacks. This is an upstream vendor fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-25649" }, "impact_statement": "CVE-2020-25649 (XXE vulnerability in DOMDeserializer) was fixed by upstream FasterXML in version 2.9.10.7 (released 02-Dec-2020). The target repository is at version 2.9.10.8 (released 06-Jan-2021), which contains the complete upstream fix. The fix adds two XML parser security features: disallow-doctype-decl=true and load-external-dtd=false, preventing XXE attacks. This is an upstream vendor fix, not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35490" }, "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2020-35491 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35491" }, "action_statement": "Vulnerability CVE-2020-35491 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2020-35728 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-35728" }, "action_statement": "Vulnerability CVE-2020-35728 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36179" }, "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36180" }, "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2020-36181 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36181" }, "action_statement": "Vulnerability CVE-2020-36181 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2020-36182 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36182" }, "action_statement": "Vulnerability CVE-2020-36182 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2020-36183 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36183" }, "action_statement": "Vulnerability CVE-2020-36183 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2020-36184 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36184" }, "action_statement": "Vulnerability CVE-2020-36184 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2020-36185 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36185" }, "action_statement": "Vulnerability CVE-2020-36185 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36186" }, "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2020-36187 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36187" }, "action_statement": "Vulnerability CVE-2020-36187 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2020-36188 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36188" }, "action_statement": "Vulnerability CVE-2020-36188 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:07:07.266705+00:00", "status_notes": "Vulnerability CVE-2020-36189 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36189" }, "action_statement": "Vulnerability CVE-2020-36189 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-36518" }, "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2020-8840 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-8840" }, "action_statement": "Vulnerability CVE-2020-8840 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:39:12.873936+00:00", "status_notes": "Vulnerability CVE-2020-9546 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9546" }, "action_statement": "Vulnerability CVE-2020-9546 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2020-9547 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9547" }, "action_statement": "Vulnerability CVE-2020-9547 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:22:24.364492+00:00", "status_notes": "Vulnerability CVE-2020-9548 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2020-9548" }, "action_statement": "Vulnerability CVE-2020-9548 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T23:14:38.175256+00:00", "status_notes": "Vulnerability CVE-2021-20190 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-20190" }, "action_statement": "Vulnerability CVE-2021-20190 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:13:36.432303+00:00", "status_notes": "Vulnerability CVE-2021-46877 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2021-46877" }, "action_statement": "Vulnerability CVE-2021-46877 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42003" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2022-42004 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2022-42004" }, "action_statement": "Vulnerability CVE-2022-42004 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2023-35116 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability", "vulnerability": { "name": "CVE-2023-35116" }, "action_statement": "Vulnerability CVE-2023-35116 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-19032" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-50193" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.10.8 is NOT AFFECTED by CVE-2026-54512. The vulnerability specifically targets PolymorphicTypeValidator (PTV), a configurable validation mechanism introduced in jackson-databind 2.10.0. Version 2.9.10.8 predates PTV and uses a fundamentally different validation architecture (SubTypeValidator with hardcoded deny-list). The CVE describes bypassing \"an explicitly configured PTV allow-list\" via generic type parameters\u2014a mechanism that does not exist in 2.9.10.8. The affected component is absent from this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-54512" }, "impact_statement": "Version 2.9.10.8 is NOT AFFECTED by CVE-2026-54512. The vulnerability specifically targets PolymorphicTypeValidator (PTV), a configurable validation mechanism introduced in jackson-databind 2.10.0. Version 2.9.10.8 predates PTV and uses a fundamentally different validation architecture (SubTypeValidator with hardcoded deny-list). The CVE describes bypassing \"an explicitly configured PTV allow-list\" via generic type parameters\u2014a mechanism that does not exist in 2.9.10.8. The affected component is absent from this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability CVE-2026-54513 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54513" }, "action_statement": "Vulnerability CVE-2026-54513 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54514" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54515" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-54516 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54516" }, "action_statement": "Vulnerability CVE-2026-54516 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-54517 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54517" }, "action_statement": "Vulnerability CVE-2026-54517 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-54518 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-54518" }, "action_statement": "Vulnerability CVE-2026-54518 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T01:02:19.900071+00:00", "status_notes": "Vulnerability CVE-2026-59888 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59888" }, "action_statement": "Vulnerability CVE-2026-59888 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-59889" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2026-68497 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-68497" }, "action_statement": "Vulnerability CVE-2026-68497 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2026-77310 is fixed in version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-77310" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T00:12:47.728703+00:00", "status_notes": "Vulnerability CVE-2026-83557 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-83557" }, "action_statement": "Vulnerability CVE-2026-83557 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2026-91776 is fixed in version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91776" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability CVE-2026-91777 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "CVE-2026-91777" }, "action_statement": "Vulnerability CVE-2026-91777 affects version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-28T18:23:53.811682+00:00", "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.8-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.", "vulnerability": { "name": "GHSA-mhm7-754m-9p8w" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.8-tuxcare.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wrr7-33fx-rcvj is a false positive for com.fasterxml.jackson.core:jackson-databind 2.9.10.8-tuxcare.2.", "vulnerability": { "name": "GHSA-wrr7-33fx-rcvj" }, "impact_statement": "The vulnerability has been withdrawn." } ] }