{
  "@id": "urn:uuid:807c2fee-6040-408c-9f07-f3fb224946bc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:02:52.397356+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:24:00.098649+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128 is NOT present in jackson-core 2.16.1. The vulnerability, where JsonLocation's exception message building would read from byte array index 0 instead of respecting the offset parameter (leaking up to 500 bytes of unintended memory from pooled buffers), was fixed by upstream author Tatu Saloranta in commit a6c297682737dde13337cb7c3020f299518609a8 (April 2021), released in version 2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-49128 is NOT present in jackson-core 2.16.1. The vulnerability, where JsonLocation's exception message building would read from byte array index 0 instead of respecting the offset parameter (leaking up to 500 bytes of unintended memory from pooled buffers), was fixed by upstream author Tatu Saloranta in commit a6c297682737dde13337cb7c3020f299518609a8 (April 2021), released in version 2..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:52.397356+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target jackson-core 2.16.1-tuxcare.1 is NOT AFFECTED by CVE-2025-52999. The nesting depth validation fix (commit 54f78a9c by PJ Fanning) was introduced in upstream jackson-core 2.15.0 and was already present in the upstream 2.16.1 release that TuxCare onboarded (commit 8f3793e2). The fix adds a configurable maximum nesting depth (default 1000) with validation that throws StreamConstraintsException before stack overflow occurs. All parser implementations (ReaderBasedJsonParser, UTF8DataInputJsonParser, UTF8StreamJsonParser, NonBlockingJsonParserBase) properly invoke the validation via createChildArrayContext/createChildObjectContext methods in ParserBase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "Target jackson-core 2.16.1-tuxcare.1 is NOT AFFECTED by CVE-2025-52999. The nesting depth validation fix (commit 54f78a9c by PJ Fanning) was introduced in upstream jackson-core 2.15.0 and was already present in the upstream 2.16.1 release that TuxCare onboarded (commit 8f3793e2). The fix adds a configurable maximum nesting depth (default 1000) with validation that throws StreamConstraintsException before stack overflow occurs. All parser implementations (ReaderBasedJsonParser, UTF8DataInputJsonParser, UTF8StreamJsonParser, NonBlockingJsonParserBase) properly invoke the validation via createChildArrayContext/createChildObjectContext methods in ParserBase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T17:41:00.097583+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T17:41:00.097583+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 is fixed in version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T17:41:00.097583+00:00",
      "status_notes": "Vulnerability CVE-2026-68498 affects version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68498"
      },
      "action_statement": "Vulnerability CVE-2026-68498 affects version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T17:41:00.097583+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. The target jackson-core version 2.16.1 is NOT AFFECTED by CVE-2026-89407. The vulnerable method NumberInput.looksLikeValidNumber() was first added in 2.17.0 (commit c381325d55a, December 2023); its PATTERN_FLOAT regex took the ReDoS-prone form in 2.17.1 (commit c73bde244), and PATTERN_FLOAT_TRAILING_DOT was added in 2.17.2 (commit 55261befb). All of this postdates the target version. Version 2.16.1 does not contain this method or these patterns anywhere in the codebase. This is a clear case of the vulnerability being introduced in a later version than the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "The target jackson-core version 2.16.1 is NOT AFFECTED by CVE-2026-89407. The vulnerable method NumberInput.looksLikeValidNumber() was first added in 2.17.0 (commit c381325d55a, December 2023); its PATTERN_FLOAT regex took the ReDoS-prone form in 2.17.1 (commit c73bde244), and PATTERN_FLOAT_TRAILING_DOT was added in 2.17.2 (commit 55261befb). All of this postdates the target version. Version 2.16.1 does not contain this method or these patterns anywhere in the codebase. This is a clear case of the vulnerability being introduced in a later version than the target."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T17:41:00.097583+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T17:41:00.097583+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T17:41:00.097583+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.16.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    }
  ]
}