{
  "@id": "urn:uuid:c38249d0-149e-4280-8ab4-6f0a40e4346a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-20T05:36:00.078362+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2019-14540 does not affect version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 CVE-2019-14540 is already fixed in the target repository. The blocklist entries for com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource are present in SubTypeValidator.java, matching the upstream patches exactly.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14540"
      },
      "impact_statement": "already_fixed \u2014 CVE-2019-14540 is already fixed in the target repository. The blocklist entries for com.zaxxer.hikari.HikariConfig and com.zaxxer.hikari.HikariDataSource are present in SubTypeValidator.java, matching the upstream patches exactly."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2019-14892 does not affect version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 CVE-2019-14892 is NOT present in the target repository. The fix for this vulnerability was already applied via upstream commits 41b7f9b90 and 819cdbcab, which are ancestors of the target SHA 38f9af6f3. The SubTypeValidator class contains the blocklist entries for both org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration at lines 112-114, pre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14892"
      },
      "impact_statement": "already_fixed \u2014 CVE-2019-14892 is NOT present in the target repository. The fix for this vulnerability was already applied via upstream commits 41b7f9b90 and 819cdbcab, which are ancestors of the target SHA 38f9af6f3. The SubTypeValidator class contains the blocklist entries for both org.apache.commons.configuration.JNDIConfiguration and org.apache.commons.configuration2.JNDIConfiguration at lines 112-114, pre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2019-14893 does not affect version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 The target repository already contains the fix for CVE-2019-14893. The xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) has been added to the deserialization blacklist in SubTypeValidator.java, preventing polymorphic deserialization attacks using this gadget.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-14893"
      },
      "impact_statement": "already_fixed \u2014 The target repository already contains the fix for CVE-2019-14893. The xalan JNDI gadget class (org.apache.xalan.lib.sql.JNDIConnectionPool) has been added to the deserialization blacklist in SubTypeValidator.java, preventing polymorphic deserialization attacks using this gadget."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2019-16335 does not affect version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 CVE-2019-16335: The target repository already contains the fix. Commit 73c1c2cc7 (upstream Fix #2449) is present in the current branch, adding 'com.zaxxer.hikari.HikariDataSource' to the deserialization blocklist in SubTypeValidator.java at line 107. The defense is active and prevents polymorphic deserialization of this gadget class.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-16335"
      },
      "impact_statement": "already_fixed \u2014 CVE-2019-16335: The target repository already contains the fix. Commit 73c1c2cc7 (upstream Fix #2449) is present in the current branch, adding 'com.zaxxer.hikari.HikariDataSource' to the deserialization blocklist in SubTypeValidator.java at line 107. The defense is active and prevents polymorphic deserialization of this gadget class."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2019-17267 does not affect version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. already_fixed \u2014 CVE-2019-17267 fix is already present in the target repository. The dangerous class 'net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup' is blocked from polymorphic deserialization by an entry in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 99, which is the exact fix from upstream commit 191a4cdf87b56d2ddddb77edd895ee756b7f75eb.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-17267"
      },
      "impact_statement": "already_fixed \u2014 CVE-2019-17267 fix is already present in the target repository. The dangerous class 'net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup' is blocked from polymorphic deserialization by an entry in SubTypeValidator's DEFAULT_NO_DESER_CLASS_NAMES blocklist at line 99, which is the exact fix from upstream commit 191a4cdf87b56d2ddddb77edd895ee756b7f75eb."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-24616 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-24616"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-24750 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-24750"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-25649 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-25649"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-35490 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35490"
      },
      "action_statement": "Vulnerability CVE-2020-35490 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:36:00.078362+00:00",
      "status_notes": "Vulnerability CVE-2020-35491 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35491"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-35728 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-35728"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36179 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36179"
      },
      "action_statement": "Vulnerability CVE-2020-36179 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36180 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36180"
      },
      "action_statement": "Vulnerability CVE-2020-36180 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36181 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36181"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36182 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36182"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36183 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36183"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36184 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36184"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36185 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36185"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36186 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36186"
      },
      "action_statement": "Vulnerability CVE-2020-36186 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36187 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36187"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36188 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36188"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36189 does not affect version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. Version 2.9.10.5 is not affected by CVE-2020-36189: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2020-36189"
      },
      "impact_statement": "Version 2.9.10.5 is not affected by CVE-2020-36189: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2020-36518 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2020-36518"
      },
      "action_statement": "Vulnerability CVE-2020-36518 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:36:00.078362+00:00",
      "status_notes": "Vulnerability CVE-2021-20190 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2021-20190"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2022-42003 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42003"
      },
      "action_statement": "Vulnerability CVE-2022-42003 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2022-42004 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2022-42004"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2023-35116 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability",
      "vulnerability": {
        "name": "CVE-2023-35116"
      },
      "action_statement": "Vulnerability CVE-2023-35116 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind and will not be fixed. The maintainers classify this as a not a vulnerability, as it stems from stack overflows caused by serializing objects with cyclic dependencies, which is considered a misuse rather than a vulnerability"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:36:00.078362+00:00",
      "status_notes": "Vulnerability CVE-2026-19032 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-19032"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:36:00.078362+00:00",
      "status_notes": "Vulnerability CVE-2026-50193 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-50193"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-54512 does not affect version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind. not_affected \u2014 CVE-2026-54512 specifically concerns bypassing PolymorphicTypeValidator (PTV) via generic type parameters. The target repository is jackson-databind version 2.9.10.5, which predates the introduction of PolymorphicTypeValidator (introduced in version 2.10.0). The CVE's affected version range explicitly starts at 2.10.0 and the vulnerability description focuses entirely on PTV bypass. Without PTV...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-54512"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-54512 specifically concerns bypassing PolymorphicTypeValidator (PTV) via generic type parameters. The target repository is jackson-databind version 2.9.10.5, which predates the introduction of PolymorphicTypeValidator (introduced in version 2.10.0). The CVE's affected version range explicitly starts at 2.10.0 and the vulnerability description focuses entirely on PTV bypass. Without PTV..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:36:00.078362+00:00",
      "status_notes": "Vulnerability CVE-2026-54514 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54514"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:36:00.078362+00:00",
      "status_notes": "Vulnerability CVE-2026-54515 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-54515"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:36:00.078362+00:00",
      "status_notes": "Vulnerability CVE-2026-59889 is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-59889"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-68497 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-68497"
      },
      "action_statement": "Vulnerability CVE-2026-68497 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-77310 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-77310"
      },
      "action_statement": "Vulnerability CVE-2026-77310 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-91776 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91776"
      },
      "action_statement": "Vulnerability CVE-2026-91776 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:35:01.686871+00:00",
      "status_notes": "Vulnerability CVE-2026-91777 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "CVE-2026-91777"
      },
      "action_statement": "Vulnerability CVE-2026-91777 affects version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.10.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-20T05:36:00.078362+00:00",
      "status_notes": "Vulnerability GHSA-mhm7-754m-9p8w is fixed in version 2.9.10.5-tuxcare.1 of com.fasterxml.jackson.core:jackson-databind.",
      "vulnerability": {
        "name": "GHSA-mhm7-754m-9p8w"
      }
    }
  ]
}