{ "@context": "https://openvex.dev/ns/v0.2.0", "@id": "https://vulnlog.dev/vex/849578f8-e757-4385-82a3-6aa017494e99", "author": "Vulnlog Dev Team", "role": "Document Creator", "timestamp": "2026-10-10T12:59:47Z", "version": 3, "tooling": "Vulnlog Gradle plugin version 0.18.0, https://vulnlog.dev/", "statements": [ { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw needs a `java.nio.file.Path` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `Path`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-19032", "name": "CVE-2026-19032", "description": "jackson-databind resolves a `java.nio.file.Path` through any installed `FileSystemProvider` without a scheme allowlist.", "aliases": [ "GHSA-wjgm-6hv5-3cvf" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is a `javax.xml.datatype` `Duration` or `XMLGregorianCalendar`, so the vulnerable deserializer never runs.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-68497", "name": "CVE-2026-68497", "description": "jackson-databind parses unbounded numbers when deserializing `javax.xml.datatype` `Duration` and `XMLGregorianCalendar` values, which exhausts CPU.", "aliases": [ "GHSA-q4xh-88c3-wmh7" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The DNS lookup needs an `InetAddress` value bound from input. Vulnlog binds its input only to its own DTOs, whose fields are strings, dates, lists, maps and nested DTOs. None is an `InetAddress`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-77310", "name": "CVE-2026-77310", "description": "jackson-databind still resolves DNS eagerly when deserializing `InetAddress`, an incomplete fix for CVE-2026-54514.", "aliases": [ "GHSA-vvgp-rfg2-7rr6" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The validator only runs for polymorphic typing. Vulnlog's DTOs use no `@JsonTypeInfo`, and Vulnlog never activates default typing.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-83557", "name": "CVE-2026-83557", "description": "jackson-databind's default polymorphic type validator misses `Comparable` among its unsafe base types.", "aliases": [ "GHSA-gx83-3vf8-gh7j" ] }, "timestamp": "2026-08-23T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The flaw sits in the parser Jackson creates for a `java.io.DataInput` source. Vulnlog never reads from a `DataInput`; it parses its input from files and strings.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-89425", "name": "CVE-2026-89425", "description": "jackson-core `UTF8DataInputJsonParser` builds invalid-token error messages without the `maxErrorTokenLength` limit.", "aliases": [ "GHSA-7hhh-6rmp-j9qf" ] }, "timestamp": "2026-09-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-core@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-core@3.2.2" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The growth needs name-based polymorphic typing with a default implementation. Vulnlog's DTOs use no `@JsonTypeInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91776", "name": "CVE-2026-91776", "description": "jackson-databind caches a deserializer per unknown `@JsonTypeInfo` type ID, so new IDs grow memory without bound.", "aliases": [ "GHSA-wv8q-qhhj-9h54" ] }, "timestamp": "2026-09-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.12.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.13.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.14.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-10-10T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "The quadratic work needs a collection or map of `@JsonIdentityInfo` objects. No Vulnlog type uses `@JsonIdentityInfo`.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://nvd.nist.gov/vuln/detail/CVE-2026-91777", "name": "CVE-2026-91777", "description": "jackson-databind resolves `@JsonIdentityInfo` forward references in quadratic time, which exhausts CPU.", "aliases": [ "GHSA-cxp5-3px4-pw24" ] }, "timestamp": "2026-09-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } }, { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.2" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17434789", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17434789", "description": "Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`.", "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the affected class is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17434789", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17434789", "description": "Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`.", "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17434789", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17434789", "description": "Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`.", "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17434789", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17434789", "description": "Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`.", "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17434789", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17434789", "description": "Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`.", "aliases": [ "CVE-2026-54514", "GHSA-hgj6-7826-r7m5" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440306", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440306", "description": "Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method.", "aliases": [ "CVE-2026-54517", "GHSA-5hh8-q8hv-fr38" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440306", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440306", "description": "Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method.", "aliases": [ "CVE-2026-54517", "GHSA-5hh8-q8hv-fr38" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440306", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440306", "description": "Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method.", "aliases": [ "CVE-2026-54517", "GHSA-5hh8-q8hv-fr38" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440306", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440306", "description": "Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method.", "aliases": [ "CVE-2026-54517", "GHSA-5hh8-q8hv-fr38" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440306", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440306", "description": "Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method.", "aliases": [ "CVE-2026-54517", "GHSA-5hh8-q8hv-fr38" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440359", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440359", "description": "Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method.", "aliases": [ "CVE-2026-54518", "GHSA-rcqc-6cw3-h962" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440359", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440359", "description": "Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method.", "aliases": [ "CVE-2026-54518", "GHSA-rcqc-6cw3-h962" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440359", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440359", "description": "Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method.", "aliases": [ "CVE-2026-54518", "GHSA-rcqc-6cw3-h962" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440359", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440359", "description": "Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method.", "aliases": [ "CVE-2026-54518", "GHSA-rcqc-6cw3-h962" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440359", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440359", "description": "Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method.", "aliases": [ "CVE-2026-54518", "GHSA-rcqc-6cw3-h962" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440365", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440365", "description": "Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods.", "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440365", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440365", "description": "Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods.", "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440365", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440365", "description": "Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods.", "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440365", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440365", "description": "Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods.", "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440365", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440365", "description": "Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods.", "aliases": [ "CVE-2026-54513", "GHSA-rmj7-2vxq-3g9f" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440597", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440597", "description": "Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method.", "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440597", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440597", "description": "Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method.", "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440597", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440597", "description": "Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method.", "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440597", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440597", "description": "Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method.", "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17440597", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17440597", "description": "Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method.", "aliases": [ "CVE-2026-54512", "GHSA-j3rv-43j4-c7qm" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457396", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457396", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods.", "aliases": [ "CVE-2026-54516", "GHSA-9fxm-vc8v-hj55" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457396", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457396", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods.", "aliases": [ "CVE-2026-54516", "GHSA-9fxm-vc8v-hj55" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457396", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457396", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods.", "aliases": [ "CVE-2026-54516", "GHSA-9fxm-vc8v-hj55" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457396", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457396", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods.", "aliases": [ "CVE-2026-54516", "GHSA-9fxm-vc8v-hj55" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457396", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457396", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods.", "aliases": [ "CVE-2026-54516", "GHSA-9fxm-vc8v-hj55" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457696", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457696", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method.", "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Vulnlog uses Jackson for de-/serialization but the method in question is not used.", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457696", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457696", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method.", "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.15.1" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457696", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457696", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method.", "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.16.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457696", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457696", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method.", "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.17.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" }, { "vulnerability": { "@id": "https://security.snyk.io/vuln/SNYK-JAVA-TOOLSJACKSONCORE-17457696", "name": "SNYK-JAVA-TOOLSJACKSONCORE-17457696", "description": "Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method.", "aliases": [ "CVE-2026-54515", "GHSA-5jmj-h7xm-6q6v" ] }, "timestamp": "2026-06-29T00:00:00Z", "products": [ { "@id": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0", "identifiers": { "purl": "pkg:maven/dev.vulnlog/gradle-plugin@0.18.0" }, "subcomponents": [ { "@id": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1", "identifiers": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } ] } ], "status": "fixed", "supplier": "Vulnlog" } ] }