{
  "@id": "urn:uuid:3d3a17c4-5bd7-4760-920b-00b756886ce8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T11:59:19.723998+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:18:00.165343+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128 (jackson-core issue #652) is NOT present in jackson-core 2.15.4-tuxcare.2. The vulnerability, which allowed disclosure of residual buffer data before the offset in exception messages when using createParser(byte[], offset, length), was fixed by upstream in jackson-core 2.13.0 (April 2021, commit a6c29768). The target version 2.15.4 was released in October 2023 with this fix alrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-49128 (jackson-core issue #652) is NOT present in jackson-core 2.15.4-tuxcare.2. The vulnerability, which allowed disclosure of residual buffer data before the offset in exception messages when using createParser(byte[], offset, length), was fixed by upstream in jackson-core 2.13.0 (April 2021, commit a6c29768). The target version 2.15.4 was released in October 2023 with this fix alrea..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:19.723998+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. CVE-2025-52999 nesting depth validation fix is present in target jackson-core 2.15.4-tuxcare.2. The fix (commit 54f78a9c by PJ Fanning) was included in the upstream 2.15.0 release and therefore already present in the upstream 2.15.4 release that TuxCare onboarded. The defense is active by default (DEFAULT_MAX_DEPTH=1000) and consistently applied across all parsers via ParserBase helper methods that validate nesting depth before creating child contexts. The vulnerable pattern (unbounded recursion from deeply nested input) cannot occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "CVE-2025-52999 nesting depth validation fix is present in target jackson-core 2.15.4-tuxcare.2. The fix (commit 54f78a9c by PJ Fanning) was included in the upstream 2.15.0 release and therefore already present in the upstream 2.15.4 release that TuxCare onboarded. The defense is active by default (DEFAULT_MAX_DEPTH=1000) and consistently applied across all parsers via ParserBase helper methods that validate nesting depth before creating child contexts. The vulnerable pattern (unbounded recursion from deeply nested input) cannot occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:12:16.931559+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 is fixed in version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:15:05.610606+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.15.4-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "action_statement": "Vulnerability CVE-2026-68494 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.15.4-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:44:00.186938+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target version 2.15.4 is not affected by CVE-2026-89407. The vulnerable method looksLikeValidNumber() and its associated regex patterns (PATTERN_FLOAT, PATTERN_FLOAT_TRAILING_DOT) do not exist in this version. These components were introduced in jackson-core 2.17, which is after the target's 2.15.4. The target predates the vulnerable code introduction.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "Target version 2.15.4 is not affected by CVE-2026-89407. The vulnerable method looksLikeValidNumber() and its associated regex patterns (PATTERN_FLOAT, PATTERN_FLOAT_TRAILING_DOT) do not exist in this version. These components were introduced in jackson-core 2.17, which is after the target's 2.15.4. The target predates the vulnerable code introduction."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:44:00.186938+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:44:00.186938+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:28:31.286690+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.15.4-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.15.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.15.4-tuxcare.2."
    }
  ]
}