{
  "@id": "urn:uuid:914fee5c-eff5-4c0a-bbfd-8f09790da9d9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:22:00.166640+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:22:00.166640+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The target jackson-core 2.14.3-tuxcare.2 is NOT AFFECTED by CVE-2025-49128. The vulnerability (byte array offset ignored in exception messages, causing information disclosure from pooled buffers) was fixed in upstream commit a6c29768 by Tatu Saloranta, which was already present in the upstream release 2.14.3 that TuxCare onboarded. The vulnerable code pattern (reading from byte array index 0 in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 The target jackson-core 2.14.3-tuxcare.2 is NOT AFFECTED by CVE-2025-49128. The vulnerability (byte array offset ignored in exception messages, causing information disclosure from pooled buffers) was fixed in upstream commit a6c29768 by Tatu Saloranta, which was already present in the upstream release 2.14.3 that TuxCare onboarded. The vulnerable code pattern (reading from byte array index 0 in..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:44:00.186938+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "action_statement": "Vulnerability CVE-2025-52999 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T14:10:59.626624+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "action_statement": "Vulnerability CVE-2026-68494 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.14.3-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:44:00.186938+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. CVE-2026-89407 is NOT present in jackson-core 2.14.3. The vulnerable method `NumberInput.looksLikeValidNumber()` with its quadratic-time regex patterns (PATTERN_FLOAT, PATTERN_FLOAT_TRAILING_DOT) was introduced in version 2.17.0, which is AFTER the target version 2.14.3. The target repository does not contain the vulnerable code path at all.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "CVE-2026-89407 is NOT present in jackson-core 2.14.3. The vulnerable method `NumberInput.looksLikeValidNumber()` with its quadratic-time regex patterns (PATTERN_FLOAT, PATTERN_FLOAT_TRAILING_DOT) was introduced in version 2.17.0, which is AFTER the target version 2.14.3. The target repository does not contain the vulnerable code path at all."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:45:00.246667+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:45:00.246667+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.14.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:44:00.186938+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.14.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    }
  ]
}