{
  "@id": "urn:uuid:29f3b292-4acc-4ab8-8530-7a481758f024",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:21:00.141769+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:21:00.141769+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128 is NOT present in jackson-core 2.13.3-tuxcare.1. The vulnerability (information disclosure via improper offset handling in exception messages when parsing byte arrays with offset/length) was fixed in upstream version 2.13.0 via commit a6c29768 by Tatu Saloranta. This fix was already present in the upstream 2.13.3 release that TuxCare onboarded. The target code correctly uses offs...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-49128 is NOT present in jackson-core 2.13.3-tuxcare.1. The vulnerability (information disclosure via improper offset handling in exception messages when parsing byte arrays with offset/length) was fixed in upstream version 2.13.0 via commit a6c29768 by Tatu Saloranta. This fix was already present in the upstream 2.13.3 release that TuxCare onboarded. The target code correctly uses offs..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T18:26:00.146606+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T18:26:00.146606+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "action_statement": "Vulnerability CVE-2026-68494 affects version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T18:26:00.146606+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. The target jackson-core version 2.13.3 is NOT AFFECTED by CVE-2026-89407. The vulnerable method NumberInput.looksLikeValidNumber() containing the quadratic-backtracking regex patterns does not exist in this version. The method was introduced later in version 2.17.0 (git commit c381325d, javadoc '@since 2.17'). The target version predates the vulnerable code's introduction entirely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "The target jackson-core version 2.13.3 is NOT AFFECTED by CVE-2026-89407. The vulnerable method NumberInput.looksLikeValidNumber() containing the quadratic-backtracking regex patterns does not exist in this version. The method was introduced later in version 2.17.0 (git commit c381325d, javadoc '@since 2.17'). The target version predates the vulnerable code's introduction entirely."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T18:26:00.146606+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T18:26:00.146606+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T18:26:00.146606+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 is fixed in version 2.13.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      }
    }
  ]
}