{
  "@id": "urn:uuid:bb4657af-697a-4569-a98d-85242e0b4bc7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T05:29:00.079306+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "action_statement": "Vulnerability CVE-2025-49128 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "action_statement": "Vulnerability CVE-2025-52999 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:29:00.079306+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 does not affect version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.11.4 is not affected by CVE-2026-18401. The vulnerability concerns the async parser bypassing StreamReadConstraints.maxNumberLength, a constraint mechanism introduced in jackson-core 2.15 and backported to 2.13+. Version 2.11.4 predates StreamReadConstraints entirely\u2014neither synchronous nor asynchronous parsers have any number length constraint. The CVE describes bypassing an existing...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.4 is not affected by CVE-2026-18401. The vulnerability concerns the async parser bypassing StreamReadConstraints.maxNumberLength, a constraint mechanism introduced in jackson-core 2.15 and backported to 2.13+. Version 2.11.4 predates StreamReadConstraints entirely\u2014neither synchronous nor asynchronous parsers have any number length constraint. The CVE describes bypassing an existing..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.11.4 is not affected by CVE-2026-68494. This CVE describes an incomplete fix for a number-length constraint bypass in jackson-core 2.18.6 and 2.21.1, where the StreamReadConstraints.maxNumberLength validation can be bypassed via the async parser's streaming path. Version 2.11.4 predates the introduction of StreamReadConstraints entirely (added in commit e95dd282). The CVE specifically...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.4 is not affected by CVE-2026-68494. This CVE describes an incomplete fix for a number-length constraint bypass in jackson-core 2.18.6 and 2.21.1, where the StreamReadConstraints.maxNumberLength validation can be bypassed via the async parser's streaming path. Version 2.11.4 predates the introduction of StreamReadConstraints entirely (added in commit e95dd282). The CVE specifically..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. jackson-core version 2.11.4 is NOT AFFECTED by CVE-2026-89407. The vulnerable looksLikeValidNumber() method with quadratic regex backtracking was introduced in version 2.17.0 and does not exist in the 2.11.4 codebase. NumberInput in this version contains no regex patterns. The vulnerable mechanism is structurally absent from this older version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "jackson-core version 2.11.4 is NOT AFFECTED by CVE-2026-89407. The vulnerable looksLikeValidNumber() method with quadratic regex backtracking was introduced in version 2.17.0 and does not exist in the 2.11.4 codebase. NumberInput in this version contains no regex patterns. The vulnerable mechanism is structurally absent from this older version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:53:00.092164+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "action_statement": "Vulnerability GHSA-72hv-8253-57qq affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    }
  ]
}