{
  "@id": "urn:uuid:f4dbd360-ac7b-4f10-a87e-3491a699fcd0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T20:35:00.210243+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 does not affect version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2020-36518: unbounded recursion in jackson-databind's untyped deserializer lets deeply nested JSON exhaust the JVM stack (StackOverflowError \u2192 DoS) for versions before 2.13.0. Target is jackson-databind 2.12.7.1 (TuxCare ELS fork). The canonical upstream fix \u2014 a MAX_DEPTH=1000 nesting-depth limit in UntypedObjectDeserializer.Vanilla \u2014 is PRESENT and functionally complete in the target. deserialize() checks `depth > MAX_DEPTH` and throws JsonParseException(\"JSON is too deeply nested.\") before recursing (lines 714-715, 730-731); depth is incremented once per nesting level via `++depth` at the top of mapArray (879), mapArrayToArray (918), and mapObject (938). This matches upstream commit fcfc4998 exactly. The fix was introduced by upstream commit 83b928dab9 \"Prepare for 2.12.6.1 release\" (upstream's dedicated security release for CVE-2020-36518), authored and committed by upstream maintainer Tatu Saloranta <tatu.saloranta@iki.fi>. That commit is an ancestor of the TuxCare onboard commit c7e6f711f, so the fix is part of the onboarded upstream baseline \u2014 NOT a TuxCare backport. Because an upstream/vendor-authored fix is already applied in the shipped version, the vulnerable pattern is not present in HEAD \u2192 not_affected, justification code_not_present. (Note: TuxCare's own CVE-2020-36518 backport exists only on the older 2.12.1 branch (ea53359db), which predated the upstream fix; 2.12.7.1 needed no such backport.) [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-36518: unbounded recursion in jackson-databind's untyped deserializer lets deeply nested JSON exhaust the JVM stack (StackOverflowError \u2192 DoS) for versions before 2.13.0. Target is jackson-databind 2.12.7.1 (TuxCare ELS fork). The canonical upstream fix \u2014 a MAX_DEPTH=1000 nesting-depth limit in UntypedObjectDeserializer.Vanilla \u2014 is PRESENT and functionally complete in the target. deserialize() checks `depth > MAX_DEPTH` and throws JsonParseException(\"JSON is too deeply nested.\") before recursing (lines 714-715, 730-731); depth is incremented once per nesting level via `++depth` at the top of mapArray (879), mapArrayToArray (918), and mapObject (938). This matches upstream commit fcfc4998 exactly. The fix was introduced by upstream commit 83b928dab9 \"Prepare for 2.12.6.1 release\" (upstream's dedicated security release for CVE-2020-36518), authored and committed by upstream maintainer Tatu Saloranta <tatu.saloranta@iki.fi>. That commit is an ancestor of the TuxCare onboard commit c7e6f711f, so the fix is part of the onboarded upstream baseline \u2014 NOT a TuxCare backport. Because an upstream/vendor-authored fix is already applied in the shipped version, the vulnerable pattern is not present in HEAD \u2192 not_affected, justification code_not_present. (Note: TuxCare's own CVE-2020-36518 backport exists only on the older 2.12.1 branch (ea53359db), which predated the upstream fix; 2.12.7.1 needed no such backport.) [VC re-run with claude-opus-4-8, prod prompt pin d46bd7a, 2026-09-16; Sonnet run failed the author gate (A2 onboarding-merge overclaim); applied manually after git verification]"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "action_statement": "Vulnerability CVE-2026-54512 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-54513 is fixed in version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54513"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      },
      "action_statement": "Vulnerability CVE-2026-54514 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      },
      "action_statement": "Vulnerability CVE-2026-54515 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      },
      "action_statement": "Vulnerability CVE-2026-59889 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-83557 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-83557"
      },
      "action_statement": "Vulnerability CVE-2026-83557 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-19T20:35:00.210243+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.12.7.1-tuxcare.2 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    }
  ]
}