{
  "@id": "urn:uuid:708ae777-d3a6-4d0c-aaf9-063c705159e6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:22:00.166640+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:22:00.166640+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128 is NOT present in jackson-core 2.14.1-tuxcare.2. The vulnerability (incorrect offset handling in JsonLocation._appendSourceDesc causing information disclosure from pooled buffers) was fixed in upstream version 2.13.0 (April 2021) by commit a6c297682737dde13337cb7c3020f299518609a8. The target version 2.14.1 (November 2022) includes this upstream fix. The vulnerable code pattern (r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-49128 is NOT present in jackson-core 2.14.1-tuxcare.2. The vulnerability (incorrect offset handling in JsonLocation._appendSourceDesc causing information disclosure from pooled buffers) was fixed in upstream version 2.13.0 (April 2021) by commit a6c297682737dde13337cb7c3020f299518609a8. The target version 2.14.1 (November 2022) includes this upstream fix. The vulnerable code pattern (r..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T21:38:00.087926+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "action_statement": "Vulnerability CVE-2026-68494 affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.1-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T09:28:00.123686+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target version 2.14.1 is not affected by CVE-2026-89407. The vulnerable method NumberInput.looksLikeValidNumber() containing the regex patterns PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT does not exist in this version. The method was only introduced in version 2.17+ via commit c381325d on December 9, 2023, over a year after version 2.14.1 was released (November 21, 2022). Comprehensive search confirms no alternative regex-based number validation exists in the target that could exhibit similar quadratic backtracking behavior.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "Target version 2.14.1 is not affected by CVE-2026-89407. The vulnerable method NumberInput.looksLikeValidNumber() containing the regex patterns PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT does not exist in this version. The method was only introduced in version 2.17+ via commit c381325d on December 9, 2023, over a year after version 2.14.1 was released (November 21, 2022). Comprehensive search confirms no alternative regex-based number validation exists in the target that could exhibit similar quadratic backtracking behavior."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T21:38:00.087926+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      },
      "action_statement": "Vulnerability CVE-2026-89425 affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T21:38:00.087926+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "action_statement": "Vulnerability GHSA-72hv-8253-57qq affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T21:38:00.087926+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T21:38:00.087926+00:00",
      "status_notes": "Vulnerability sonatype-2022-6438 affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.1-tuxcare.2.",
      "vulnerability": {
        "name": "sonatype-2022-6438"
      },
      "action_statement": "Vulnerability sonatype-2022-6438 affects version 2.14.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.1-tuxcare.2."
    }
  ]
}