{
  "@id": "urn:uuid:e3ca6eb9-6c3e-4b8e-9ae6-f49b72c982a2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:04:03.421384+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:25:00.104241+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.17.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The target jackson-core 2.17.1-tuxcare.1 is NOT vulnerable to CVE-2025-49128. The vulnerability was fixed in upstream version 2.13.0 (released September 30, 2021) via commit a6c297682737dde13337cb7c3020f299518609a8, authored by Tatu Saloranta. Version 2.17.1 is much newer and already includes this fix. The vulnerable pattern (reading from index 0 instead of the declared offset when creating exc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 The target jackson-core 2.17.1-tuxcare.1 is NOT vulnerable to CVE-2025-49128. The vulnerability was fixed in upstream version 2.13.0 (released September 30, 2021) via commit a6c297682737dde13337cb7c3020f299518609a8, authored by Tatu Saloranta. Version 2.17.1 is much newer and already includes this fix. The vulnerable pattern (reading from index 0 instead of the declared offset when creating exc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:04:03.421384+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.17.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target jackson-core 2.17.1-tuxcare.1 is not affected by CVE-2025-52999. The vulnerability (unbounded nesting depth causing StackOverflowError) was fixed in upstream jackson-core 2.15.0, and the target version 2.17.1 already includes this fix. The complete defense mechanism is present: StreamReadConstraints tracks and validates nesting depth (default max 1000), ParserBase provides wrapper methods that call validateNestingDepth(), and all parsers use these wrappers. The fix commit (54f78a9c) was authored by PJ Fanning and shipped in the upstream 2.17.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "Target jackson-core 2.17.1-tuxcare.1 is not affected by CVE-2025-52999. The vulnerability (unbounded nesting depth causing StackOverflowError) was fixed in upstream jackson-core 2.15.0, and the target version 2.17.1 already includes this fix. The complete defense mechanism is present: StreamReadConstraints tracks and validates nesting depth (default max 1000), ParserBase provides wrapper methods that call validateNestingDepth(), and all parsers use these wrappers. The fix commit (54f78a9c) was authored by PJ Fanning and shipped in the upstream 2.17.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T18:56:00.151309+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 is fixed in version 2.17.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T18:56:00.151309+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 is fixed in version 2.17.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T21:25:00.097405+00:00",
      "status_notes": "Vulnerability CVE-2026-68498 affects version 2.17.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68498"
      },
      "action_statement": "Vulnerability CVE-2026-68498 affects version 2.17.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T18:56:00.151309+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 is fixed in version 2.17.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89407"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T18:56:00.151309+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.17.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T18:56:00.151309+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.17.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.17.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-08T18:56:00.151309+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 is fixed in version 2.17.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      }
    }
  ]
}