{ "@context": "https://openvex.dev/ns/v0.2.0", "@id": "https://vulnlog.dev/vex/bb0af4a6-415b-4fc7-b436-ce81e0e07b7e", "author": "Vulnlog Dev Team", "role": "Document Creator", "timestamp": "2026-10-10T12:59:47Z", "version": 3, "tooling": "Vulnlog Gradle plugin version 0.18.0, https://vulnlog.dev/", "statements": [ { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "name": "CVE-2026-103111", "description": "Out-of-bounds write in PCRE2 JIT matching with an attacker-controlled regular expression." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1", "identifiers": { "purl": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "name": "CVE-2026-103111", "description": "Out-of-bounds write in PCRE2 JIT matching with an attacker-controlled regular expression." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1", "identifiers": { "purl": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "PCRE2 enters the image through the Debian base only; the entrypoint is the Vulnlog native binary, which links just libc and libz and never loads libpcre2. Nothing in the container compiles or matches PCRE2 patterns.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822", "name": "CVE-2026-11822", "description": "Memory corruption in the SQLite FTS5 extension when reading a crafted database." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1", "identifiers": { "purl": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822", "name": "CVE-2026-11822", "description": "Memory corruption in the SQLite FTS5 extension when reading a crafted database." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1", "identifiers": { "purl": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "SQLite enters the image through the Debian base only, without the `sqlite3` binary; the Vulnlog native binary links just libc and libz. Vulnlog never opens an SQLite database, let alone one with crafted FTS5 data.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824", "name": "CVE-2026-11824", "description": "Heap buffer overflow in SQLite FTS5 `fts5ChunkIterate()` via crafted page metadata." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1", "identifiers": { "purl": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824", "name": "CVE-2026-11824", "description": "Heap buffer overflow in SQLite FTS5 `fts5ChunkIterate()` via crafted page metadata." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1", "identifiers": { "purl": "pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "SQLite enters the image through the Debian base only, without the `sqlite3` binary; the Vulnlog native binary links just libc and libz. Vulnlog never opens an SQLite database, let alone one with crafted FTS5 data.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "name": "CVE-2026-13221", "description": "Perl matches incorrectly when an alternation of more than 65535 fixed strings is compiled into a trie." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-13221", "name": "CVE-2026-13221", "description": "Perl matches incorrectly when an alternation of more than 65535 fixed strings is compiled into a trie." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Perl enters the image through the Debian base only (`perl-base`); the entrypoint is the Vulnlog native binary, which links just libc and libz and never starts `perl`. No process in the container runs Perl code.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "name": "CVE-2026-14456", "description": "Unbounded memory growth in the OpenSSL QUIC server listener enables a remote denial of service." }, "timestamp": "2026-09-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2", "identifiers": { "purl": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2" } }, { "@id": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2", "identifiers": { "purl": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "name": "CVE-2026-14456", "description": "Unbounded memory growth in the OpenSSL QUIC server listener enables a remote denial of service." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2", "identifiers": { "purl": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2" } }, { "@id": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2", "identifiers": { "purl": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "OpenSSL sits in the image as a Debian base package; the Vulnlog binary links only libc and libz, so libssl is never loaded. Vulnlog is an offline CLI that reads and writes local files, opens no sockets, and therefore runs no QUIC listener that an attacker could flood with Initial packets.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-41992", "name": "CVE-2026-41992", "description": "Global buffer overflow in GNU gzip LZH decompression after an LZW file in the same run." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/gzip@1.13-1", "identifiers": { "purl": "pkg:deb/debian/gzip@1.13-1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-41992", "name": "CVE-2026-41992", "description": "Global buffer overflow in GNU gzip LZH decompression after an LZW file in the same run." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/gzip@1.13-1", "identifiers": { "purl": "pkg:deb/debian/gzip@1.13-1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "GNU gzip enters the image through the Debian base only; the entrypoint is the Vulnlog native binary, which never runs `gzip` or any other program. Vulnlog reads YAML files and never decompresses archives.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "name": "CVE-2026-42496", "description": "Perl Archive::Tar extracts symlinks whose targets point outside the extraction directory." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-42496", "name": "CVE-2026-42496", "description": "Perl Archive::Tar extracts symlinks whose targets point outside the extraction directory." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Trivy matches the Debian `perl` source package, but the image installs only `perl-base`, which does not ship Archive::Tar. The entrypoint is the Vulnlog native binary, which never starts `perl`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "name": "CVE-2026-42497", "description": "Perl Archive::Tar extracts hardlinks to paths outside the extraction directory." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-42497", "name": "CVE-2026-42497", "description": "Perl Archive::Tar extracts hardlinks to paths outside the extraction directory." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Trivy matches the Debian `perl` source package, but the image installs only `perl-base`, which does not ship Archive::Tar. The entrypoint is the Vulnlog native binary, which never starts `perl`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "name": "CVE-2026-48962", "description": "Perl IO::Compress `File::GlobMapper` evaluates an attacker-controlled output glob as code." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-48962", "name": "CVE-2026-48962", "description": "Perl IO::Compress `File::GlobMapper` evaluates an attacker-controlled output glob as code." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Trivy matches the Debian `perl` source package, but the image installs only `perl-base`, which does not ship IO::Compress. The entrypoint is the Vulnlog native binary, which never starts `perl`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "name": "CVE-2026-53612", "description": "Time-of-check-time-of-use flaw in util-linux `mount(8)` when it applies post-mount ownership or mode changes." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/bsdutils@2.41-5", "identifiers": { "purl": "pkg:deb/debian/bsdutils@2.41-5" } }, { "@id": "pkg:deb/debian/libblkid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libblkid1@2.41-5" } }, { "@id": "pkg:deb/debian/liblastlog2-2@2.41-5", "identifiers": { "purl": "pkg:deb/debian/liblastlog2-2@2.41-5" } }, { "@id": "pkg:deb/debian/libmount1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libmount1@2.41-5" } }, { "@id": "pkg:deb/debian/libsmartcols1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libsmartcols1@2.41-5" } }, { "@id": "pkg:deb/debian/libuuid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libuuid1@2.41-5" } }, { "@id": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5", "identifiers": { "purl": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5" } }, { "@id": "pkg:deb/debian/mount@2.41-5", "identifiers": { "purl": "pkg:deb/debian/mount@2.41-5" } }, { "@id": "pkg:deb/debian/util-linux@2.41-5", "identifiers": { "purl": "pkg:deb/debian/util-linux@2.41-5" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "name": "CVE-2026-53612", "description": "Time-of-check-time-of-use flaw in util-linux `mount(8)` when it applies post-mount ownership or mode changes." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/bsdutils@2.41-5", "identifiers": { "purl": "pkg:deb/debian/bsdutils@2.41-5" } }, { "@id": "pkg:deb/debian/libblkid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libblkid1@2.41-5" } }, { "@id": "pkg:deb/debian/liblastlog2-2@2.41-5", "identifiers": { "purl": "pkg:deb/debian/liblastlog2-2@2.41-5" } }, { "@id": "pkg:deb/debian/libmount1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libmount1@2.41-5" } }, { "@id": "pkg:deb/debian/libsmartcols1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libsmartcols1@2.41-5" } }, { "@id": "pkg:deb/debian/libuuid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libuuid1@2.41-5" } }, { "@id": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5", "identifiers": { "purl": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5" } }, { "@id": "pkg:deb/debian/mount@2.41-5", "identifiers": { "purl": "pkg:deb/debian/mount@2.41-5" } }, { "@id": "pkg:deb/debian/util-linux@2.41-5", "identifiers": { "purl": "pkg:deb/debian/util-linux@2.41-5" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "util-linux enters the image through the Debian base only; the entrypoint is the Vulnlog native binary, which links just libc and libz and never invokes `mount(8)`. The attack needs an `/etc/fstab` entry combining `user` with `X-mount.owner`, `X-mount.group` or `X-mount.mode`, and the image ships an unconfigured fstab with no entries at all.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "name": "CVE-2026-53613", "description": "Time-of-check-time-of-use flaw in util-linux `mount(8)` allowing an ancestor directory swap on the target path." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/bsdutils@2.41-5", "identifiers": { "purl": "pkg:deb/debian/bsdutils@2.41-5" } }, { "@id": "pkg:deb/debian/libblkid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libblkid1@2.41-5" } }, { "@id": "pkg:deb/debian/liblastlog2-2@2.41-5", "identifiers": { "purl": "pkg:deb/debian/liblastlog2-2@2.41-5" } }, { "@id": "pkg:deb/debian/libmount1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libmount1@2.41-5" } }, { "@id": "pkg:deb/debian/libsmartcols1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libsmartcols1@2.41-5" } }, { "@id": "pkg:deb/debian/libuuid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libuuid1@2.41-5" } }, { "@id": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5", "identifiers": { "purl": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5" } }, { "@id": "pkg:deb/debian/mount@2.41-5", "identifiers": { "purl": "pkg:deb/debian/mount@2.41-5" } }, { "@id": "pkg:deb/debian/util-linux@2.41-5", "identifiers": { "purl": "pkg:deb/debian/util-linux@2.41-5" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "name": "CVE-2026-53613", "description": "Time-of-check-time-of-use flaw in util-linux `mount(8)` allowing an ancestor directory swap on the target path." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/bsdutils@2.41-5", "identifiers": { "purl": "pkg:deb/debian/bsdutils@2.41-5" } }, { "@id": "pkg:deb/debian/libblkid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libblkid1@2.41-5" } }, { "@id": "pkg:deb/debian/liblastlog2-2@2.41-5", "identifiers": { "purl": "pkg:deb/debian/liblastlog2-2@2.41-5" } }, { "@id": "pkg:deb/debian/libmount1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libmount1@2.41-5" } }, { "@id": "pkg:deb/debian/libsmartcols1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libsmartcols1@2.41-5" } }, { "@id": "pkg:deb/debian/libuuid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libuuid1@2.41-5" } }, { "@id": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5", "identifiers": { "purl": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5" } }, { "@id": "pkg:deb/debian/mount@2.41-5", "identifiers": { "purl": "pkg:deb/debian/mount@2.41-5" } }, { "@id": "pkg:deb/debian/util-linux@2.41-5", "identifiers": { "purl": "pkg:deb/debian/util-linux@2.41-5" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "util-linux enters the image through the Debian base only; the entrypoint is the Vulnlog native binary, which links just libc and libz and never invokes `mount(8)`. Reaching the race requires an `/etc/fstab` entry with the `user` or `users` option, and the image ships an unconfigured fstab with no entries at all.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "name": "CVE-2026-53614", "description": "SUID `mount(8)` of util-linux trusts `LIBMOUNT_FORCE_MOUNT2`, which permits a `nosuid`/`noexec` bypass." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/bsdutils@2.41-5", "identifiers": { "purl": "pkg:deb/debian/bsdutils@2.41-5" } }, { "@id": "pkg:deb/debian/libblkid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libblkid1@2.41-5" } }, { "@id": "pkg:deb/debian/liblastlog2-2@2.41-5", "identifiers": { "purl": "pkg:deb/debian/liblastlog2-2@2.41-5" } }, { "@id": "pkg:deb/debian/libmount1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libmount1@2.41-5" } }, { "@id": "pkg:deb/debian/libsmartcols1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libsmartcols1@2.41-5" } }, { "@id": "pkg:deb/debian/libuuid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libuuid1@2.41-5" } }, { "@id": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5", "identifiers": { "purl": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5" } }, { "@id": "pkg:deb/debian/mount@2.41-5", "identifiers": { "purl": "pkg:deb/debian/mount@2.41-5" } }, { "@id": "pkg:deb/debian/util-linux@2.41-5", "identifiers": { "purl": "pkg:deb/debian/util-linux@2.41-5" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "name": "CVE-2026-53614", "description": "SUID `mount(8)` of util-linux trusts `LIBMOUNT_FORCE_MOUNT2`, which permits a `nosuid`/`noexec` bypass." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/bsdutils@2.41-5", "identifiers": { "purl": "pkg:deb/debian/bsdutils@2.41-5" } }, { "@id": "pkg:deb/debian/libblkid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libblkid1@2.41-5" } }, { "@id": "pkg:deb/debian/liblastlog2-2@2.41-5", "identifiers": { "purl": "pkg:deb/debian/liblastlog2-2@2.41-5" } }, { "@id": "pkg:deb/debian/libmount1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libmount1@2.41-5" } }, { "@id": "pkg:deb/debian/libsmartcols1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libsmartcols1@2.41-5" } }, { "@id": "pkg:deb/debian/libuuid1@2.41-5", "identifiers": { "purl": "pkg:deb/debian/libuuid1@2.41-5" } }, { "@id": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5", "identifiers": { "purl": "pkg:deb/debian/login@4.16.0-2%2Breally2.41-5" } }, { "@id": "pkg:deb/debian/mount@2.41-5", "identifiers": { "purl": "pkg:deb/debian/mount@2.41-5" } }, { "@id": "pkg:deb/debian/util-linux@2.41-5", "identifiers": { "purl": "pkg:deb/debian/util-linux@2.41-5" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "util-linux enters the image through the Debian base only; the entrypoint is the Vulnlog native binary, which links just libc and libz and never invokes `mount(8)`. An unprivileged user reaches the SUID binary only through an `/etc/fstab` entry, which the image does not have, and a default container holds no `CAP_SYS_ADMIN` to mount with either.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "name": "CVE-2026-57432", "description": "Integer overflow in Perl `pack` and `unpack` templates leads to an out-of-bounds heap read." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-57432", "name": "CVE-2026-57432", "description": "Integer overflow in Perl `pack` and `unpack` templates leads to an out-of-bounds heap read." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Perl enters the image through the Debian base only (`perl-base`); the entrypoint is the Vulnlog native binary, which links just libc and libz and never starts `perl`. No process in the container runs Perl code.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "name": "CVE-2026-57433", "description": "Signed integer overflow in Perl Storable when thawing a crafted `SX_HOOK` record." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-57433", "name": "CVE-2026-57433", "description": "Signed integer overflow in Perl Storable when thawing a crafted `SX_HOOK` record." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Trivy matches the Debian `perl` source package, but the image installs only `perl-base`, which does not ship Storable. The entrypoint is the Vulnlog native binary, which never starts `perl`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "name": "CVE-2026-8376", "description": "Heap buffer overflow in Perl regex compilation of repeated fixed strings on 32-bit builds." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-8376", "name": "CVE-2026-8376", "description": "Heap buffer overflow in Perl regex compilation of repeated fixed strings on 32-bit builds." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/perl-base@5.40.1-6", "identifiers": { "purl": "pkg:deb/debian/perl-base@5.40.1-6" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Perl enters the image through the Debian base only (`perl-base`); the entrypoint is the Vulnlog native binary, which never starts `perl`. The overflow also needs a 32-bit build, and the image is amd64.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "name": "CVE-2026-84782", "description": "OpenSSL DTLS handshake retransmission can leak heap memory to the peer or crash." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:apk/alpine/libcrypto3@3.5.8-r0", "identifiers": { "purl": "pkg:apk/alpine/libcrypto3@3.5.8-r0" } }, { "@id": "pkg:apk/alpine/libssl3@3.5.8-r0", "identifiers": { "purl": "pkg:apk/alpine/libssl3@3.5.8-r0" } }, { "@id": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2", "identifiers": { "purl": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2" } }, { "@id": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2", "identifiers": { "purl": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "OpenSSL sits in the image as a base package; the Vulnlog binary links only libc and libz, so libssl is never loaded. Vulnlog is an offline CLI that opens no sockets and speaks no DTLS.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "name": "CVE-2026-84782", "description": "OpenSSL DTLS handshake retransmission can leak heap memory to the peer or crash." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:apk/alpine/libcrypto3@3.5.8-r0", "identifiers": { "purl": "pkg:apk/alpine/libcrypto3@3.5.8-r0" } }, { "@id": "pkg:apk/alpine/libssl3@3.5.8-r0", "identifiers": { "purl": "pkg:apk/alpine/libssl3@3.5.8-r0" } }, { "@id": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2", "identifiers": { "purl": "pkg:deb/debian/libssl3t64@3.5.6-1~deb13u2" } }, { "@id": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2", "identifiers": { "purl": "pkg:deb/debian/openssl-provider-legacy@3.5.6-1~deb13u2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "OpenSSL sits in the image as a base package; the Vulnlog binary links only libc and libz, so libssl is never loaded. Vulnlog is an offline CLI that opens no sockets and speaks no DTLS.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "name": "CVE-2026-85091", "description": "Heap buffer overflow in zlib `gz_vacate()` when `gzprintf()` follows a stalled non-blocking `gzwrite()`." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:apk/alpine/zlib@1.3.2-r0", "identifiers": { "purl": "pkg:apk/alpine/zlib@1.3.2-r0" } }, { "@id": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1", "identifiers": { "purl": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The Vulnlog binary links zlib, but imports only the `inflate`, `deflate` and `crc32` routines behind `java.util.zip` and no `gz*` function. The overflow needs `gzprintf()` or `gzvprintf()` after a stalled non-blocking `gzwrite()`, which Vulnlog never calls.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "name": "CVE-2026-85091", "description": "Heap buffer overflow in zlib `gz_vacate()` when `gzprintf()` follows a stalled non-blocking `gzwrite()`." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:apk/alpine/zlib@1.3.2-r0", "identifiers": { "purl": "pkg:apk/alpine/zlib@1.3.2-r0" } }, { "@id": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1", "identifiers": { "purl": "pkg:deb/debian/zlib1g@1.3.dfsg%2Breally1.3.1-1%2Bb1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The Vulnlog binary links zlib, but imports only the `inflate`, `deflate` and `crc32` routines behind `java.util.zip` and no `gz*` function. The overflow needs `gzprintf()` or `gzvprintf()` after a stalled non-blocking `gzwrite()`, which Vulnlog never calls.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "name": "CVE-2026-86145", "description": "Out-of-bounds write in PCRE2 `pcre2_dfa_match()` when it reuses a cached workspace block." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1", "identifiers": { "purl": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "name": "CVE-2026-86145", "description": "Out-of-bounds write in PCRE2 `pcre2_dfa_match()` when it reuses a cached workspace block." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1", "identifiers": { "purl": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "PCRE2 enters the image through the Debian base only; the entrypoint is the Vulnlog native binary, which links just libc and libz and never loads libpcre2. Nothing in the container compiles or matches PCRE2 patterns.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "name": "CVE-2026-89157", "description": "Out-of-bounds write in PCRE2 `pcre2_pattern_convert()` on 32-bit platforms." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1", "identifiers": { "purl": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "name": "CVE-2026-89157", "description": "Out-of-bounds write in PCRE2 `pcre2_pattern_convert()` on 32-bit platforms." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1", "identifiers": { "purl": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "PCRE2 enters the image through the Debian base only; the Vulnlog native binary links just libc and libz and never loads libpcre2. The overflow also needs a 32-bit platform, and the image is amd64.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "name": "CVE-2026-89161", "description": "Incorrect free in PCRE2 `pcre2_jit_match()` when a copied subject is passed as match context." }, "timestamp": "2026-09-12T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1", "identifiers": { "purl": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "name": "CVE-2026-89161", "description": "Incorrect free in PCRE2 `pcre2_jit_match()` when a copied subject is passed as match context." }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1", "identifiers": { "purl": "pkg:deb/debian/libpcre2-8-0@10.46-1~deb13u1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "PCRE2 enters the image through the Debian base only; the entrypoint is the Vulnlog native binary, which links just libc and libz and never loads libpcre2. Nothing in the container compiles or matches PCRE2 patterns.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-09-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-09-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-09-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-15907550", "name": "SNYK-JAVA-TOOLSJACKSONCORE-15907550", "description": "Allocation of resources without limits or throttling vulnerability in Jackson", "aliases": [ "GHSA-2m67-wjpj-xhg9" ] }, "timestamp": "2026-04-07T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A169f86f00c2c6373d479ceb0debdcb1619d959c708c0ed11c4cd8f251a248fc4?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-15907550", "name": "SNYK-JAVA-TOOLSJACKSONCORE-15907550", "description": "Allocation of resources without limits or throttling vulnerability in Jackson", "aliases": [ "GHSA-2m67-wjpj-xhg9" ] }, "timestamp": "2026-04-07T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-15907550", "name": "SNYK-JAVA-TOOLSJACKSONCORE-15907550", "description": "Allocation of resources without limits or throttling vulnerability in Jackson", "aliases": [ "GHSA-2m67-wjpj-xhg9" ] }, "timestamp": "2026-04-07T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A54085cd0ec9c2257200b762ed68fbbd130be7f2d299a4052b0a968c5c9a83b41?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-15907550", "name": "SNYK-JAVA-TOOLSJACKSONCORE-15907550", "description": "Allocation of resources without limits or throttling vulnerability in Jackson", "aliases": [ "GHSA-2m67-wjpj-xhg9" ] }, "timestamp": "2026-04-07T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-15907550", "name": "SNYK-JAVA-TOOLSJACKSONCORE-15907550", "description": "Allocation of resources without limits or throttling vulnerability in Jackson", "aliases": [ "GHSA-2m67-wjpj-xhg9" ] }, "timestamp": "2026-04-07T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-15907550", "name": "SNYK-JAVA-TOOLSJACKSONCORE-15907550", "description": "Allocation of resources without limits or throttling vulnerability in Jackson", "aliases": [ "GHSA-2m67-wjpj-xhg9" ] }, "timestamp": "2026-04-07T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-15907550", "name": "SNYK-JAVA-TOOLSJACKSONCORE-15907550", "description": "Allocation of resources without limits or throttling vulnerability in Jackson", "aliases": [ "GHSA-2m67-wjpj-xhg9" ] }, "timestamp": "2026-04-07T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A98461f4b895233dbbdd8aa5d67325111712bf7d0bb8072a35649dac44ee8848e?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-15907550", "name": "SNYK-JAVA-TOOLSJACKSONCORE-15907550", "description": "Allocation of resources without limits or throttling vulnerability in Jackson", "aliases": [ "GHSA-2m67-wjpj-xhg9" ] }, "timestamp": "2026-04-06T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Abaaa2d71447adbd68669cb9f7084f0e332d4b123f8cc76e547461c9da7e19d90?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The affected `StreamReadConstraints` is not used in the application.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-15907550", "name": "SNYK-JAVA-TOOLSJACKSONCORE-15907550", "description": "Allocation of resources without limits or throttling vulnerability in Jackson", "aliases": [ "GHSA-2m67-wjpj-xhg9" ] }, "timestamp": "2026-04-07T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17434789", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17434789", "description": "Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`.", "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17434789", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17434789", "description": "Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`.", "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17434789", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17434789", "description": "Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`.", "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17434789", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17434789", "description": "Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`.", "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17434789", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17434789", "description": "Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`.", "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the affected class is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440306", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440306", "description": "Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method.", "aliases": [ "CVE-2026-54517", "GHSA-5hh8-q8hv-fr38" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440306", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440306", "description": "Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method.", "aliases": [ "CVE-2026-54517", "GHSA-5hh8-q8hv-fr38" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440306", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440306", "description": "Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method.", "aliases": [ "CVE-2026-54517", "GHSA-5hh8-q8hv-fr38" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440306", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440306", "description": "Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method.", "aliases": [ "CVE-2026-54517", "GHSA-5hh8-q8hv-fr38" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440306", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440306", "description": "Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method.", "aliases": [ "CVE-2026-54517", "GHSA-5hh8-q8hv-fr38" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440359", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440359", "description": "Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method.", "aliases": [ "CVE-2026-54518", "GHSA-rcqc-6cw3-h962" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440359", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440359", "description": "Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method.", "aliases": [ "CVE-2026-54518", "GHSA-rcqc-6cw3-h962" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440359", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440359", "description": "Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method.", "aliases": [ "CVE-2026-54518", "GHSA-rcqc-6cw3-h962" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440359", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440359", "description": "Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method.", "aliases": [ "CVE-2026-54518", "GHSA-rcqc-6cw3-h962" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440359", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440359", "description": "Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method.", "aliases": [ "CVE-2026-54518", "GHSA-rcqc-6cw3-h962" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440365", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440365", "description": "Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods.", "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440365", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440365", "description": "Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods.", "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440365", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440365", "description": "Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods.", "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440365", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440365", "description": "Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods.", "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440365", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440365", "description": "Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods.", "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440597", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440597", "description": "Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method.", "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440597", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440597", "description": "Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method.", "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440597", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440597", "description": "Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method.", "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440597", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440597", "description": "Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method.", "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440597", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440597", "description": "Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method.", "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457396", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457396", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods.", "aliases": [ "CVE-2026-54516", "GHSA-9fxm-vc8v-hj55" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457396", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457396", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods.", "aliases": [ "CVE-2026-54516", "GHSA-9fxm-vc8v-hj55" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457396", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457396", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods.", "aliases": [ "CVE-2026-54516", "GHSA-9fxm-vc8v-hj55" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457396", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457396", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods.", "aliases": [ "CVE-2026-54516", "GHSA-9fxm-vc8v-hj55" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457396", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457396", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods.", "aliases": [ "CVE-2026-54516", "GHSA-9fxm-vc8v-hj55" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457696", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457696", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method.", "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A3a911cd4945bde7944370fc6e2efda8b3465b00ba01a71e34219b57b864ce1d8?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457696", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457696", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method.", "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A6b5626ea656a2beb3eedeb4cfb314198b3d427d7254dc04872bffde19319c424?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457696", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457696", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method.", "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A70ce779bbf62c66553991b4964aea0098cc4a2a4fbc19b0692d1cdc6a8f83b1c?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457696", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457696", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method.", "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3A749cfdeb11cedcf7f71a37d63b9dd10490fd94e2e08d293cd30cd2095b8fd32b?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457696", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457696", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method.", "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog", "identifiers": { "purl": "pkg:oci/vulnlog@sha256%3Afa679bf55d8b48697af6dc731c8e7d3d310e22521b4617c6a6debe38fee8db89?repository_url=ghcr.io%2Fvulnlog%2Fvulnlog" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" } ] }