{
  "@id": "urn:uuid:0c4b220f-fb50-4c95-a702-ad1b687a6a12",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T20:30:30.112033+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. CVE-2020-36518 is not present in jackson-databind 2.12.7. The vulnerability was fixed by upstream vendor FasterXML in version 2.12.6.1 (commit 83b928dab9, March 26, 2022). The fix adds a MAX_DEPTH limit of 1000 levels and depth tracking to UntypedObjectDeserializer.Vanilla.deserialize(), preventing stack exhaustion from deeply nested JSON. TuxCare onboarded upstream version 2.12.7 which already contained this fix, but did not author the fix themselves.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "CVE-2020-36518 is not present in jackson-databind 2.12.7. The vulnerability was fixed by upstream vendor FasterXML in version 2.12.6.1 (commit 83b928dab9, March 26, 2022). The fix adds a MAX_DEPTH limit of 1000 levels and depth tracking to UntypedObjectDeserializer.Vanilla.deserialize(), preventing stack exhaustion from deeply nested JSON. TuxCare onboarded upstream version 2.12.7 which already contained this fix, but did not author the fix themselves."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 is fixed in version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      },
      "action_statement": "Vulnerability CVE-2022-42004 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      },
      "action_statement": "Vulnerability CVE-2026-54514 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      },
      "action_statement": "Vulnerability CVE-2026-54515 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      },
      "action_statement": "Vulnerability CVE-2026-59889 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T20:30:30.112033+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.12.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    }
  ]
}