{
  "@id": "urn:uuid:41260667-4551-4ca5-9109-25b17b212aa9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:02:52.397356+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T08:25:00.104241+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The target jackson-core 2.18.0-tuxcare.2 is NOT AFFECTED by CVE-2025-49128. The vulnerability (exception messages reading from byte-array index 0 instead of respecting the declared offset) was fixed in upstream jackson-core 2.13.0 (September 2021) via commit a6c29768. Since the target version 2.18.0 (September 2024) is later than 2.13.0, the fix was already present in the upstream release that ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 The target jackson-core 2.18.0-tuxcare.2 is NOT AFFECTED by CVE-2025-49128. The vulnerability (exception messages reading from byte-array index 0 instead of respecting the declared offset) was fixed in upstream jackson-core 2.13.0 (September 2021) via commit a6c29768. Since the target version 2.18.0 (September 2024) is later than 2.13.0, the fix was already present in the upstream release that ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:52.397356+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core. Target jackson-core 2.18.0 is NOT affected by CVE-2025-52999. The vulnerability (unbounded nesting depth causing StackOverflowError) was fixed in upstream jackson-core 2.15.0 via commit 54f78a9c by PJ Fanning. Since the target version 2.18.0 is newer than 2.15.0, the fix was already present in the upstream release when TuxCare onboarded version 2.18.0 (commit 041c5a65). All parser implementations use the depth validation that enforces a default maximum nesting depth of 1000, throwing StreamConstraintsException before stack overflow can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "Target jackson-core 2.18.0 is NOT affected by CVE-2025-52999. The vulnerability (unbounded nesting depth causing StackOverflowError) was fixed in upstream jackson-core 2.15.0 via commit 54f78a9c by PJ Fanning. Since the target version 2.18.0 is newer than 2.15.0, the fix was already present in the upstream release when TuxCare onboarded version 2.18.0 (commit 041c5a65). All parser implementations use the depth validation that enforces a default maximum nesting depth of 1000, throwing StreamConstraintsException before stack overflow can occur.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T08:00:54.400805+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T08:00:54.400805+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 is fixed in version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T08:00:54.400805+00:00",
      "status_notes": "Vulnerability CVE-2026-68498 affects version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68498"
      },
      "action_statement": "Vulnerability CVE-2026-68498 affects version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T08:00:54.400805+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 is fixed in version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89407"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T08:00:54.400805+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T08:00:54.400805+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.0-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T08:00:54.400805+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.18.0-tuxcare.2 of com.fasterxml.jackson.core:jackson-core."
    }
  ]
}