{
  "@id": "urn:uuid:4a91700e-2c1e-4d0d-a491-75fea4b5e1fb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:07:34.733429+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T08:29:00.122240+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128 affects Jackson-core's exception message generation when parsing JSON from byte arrays with offsets. The vulnerable code that read from index 0 instead of respecting the offset parameter has been fixed. In the target (jackson-core 2.18.5-tuxcare.2), the fix is present via upstream commit b89098e4 by Tatu Saloranta, which was already included in upstream version 2.18.5 before TuxC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-49128 affects Jackson-core's exception message generation when parsing JSON from byte arrays with offsets. The vulnerable code that read from index 0 instead of respecting the offset parameter has been fixed. In the target (jackson-core 2.18.5-tuxcare.2), the fix is present via upstream commit b89098e4 by Tatu Saloranta, which was already included in upstream version 2.18.5 before TuxC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:07:34.733429+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core. CVE-2025-52999 affects jackson-core versions before 2.15.0 where deeply nested JSON causes StackOverflowError. The target version 2.18.5 already contains the fix (PR #943) that adds a configurable depth limit (default 1000) via StreamReadConstraints. The fix was part of the upstream 2.18.5 release, not added by TuxCare. The vulnerable pattern (unbounded recursion without depth checks) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "CVE-2025-52999 affects jackson-core versions before 2.15.0 where deeply nested JSON causes StackOverflowError. The target version 2.18.5 already contains the fix (PR #943) that adds a configurable depth limit (default 1000) via StreamReadConstraints. The fix was part of the upstream 2.18.5 release, not added by TuxCare. The vulnerable pattern (unbounded recursion without depth checks) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T07:51:55.281190+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T07:51:55.281190+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 affects version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "action_statement": "Vulnerability CVE-2026-68494 affects version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T07:51:55.281190+00:00",
      "status_notes": "Vulnerability CVE-2026-68498 affects version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68498"
      },
      "action_statement": "Vulnerability CVE-2026-68498 affects version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T07:51:55.281190+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core 2.18.5 contains the vulnerable regex patterns in NumberInput.looksLikeValidNumber() (lines 41-42, 51-52, 646-657), but the method is not called by any production code within jackson-core itself. As a library (LIB target), jackson-core exports this public API method for external consumers (primarily jackson-databind) but does not route any attacker-controllable input to it through i...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "not_affected \u2014 jackson-core 2.18.5 contains the vulnerable regex patterns in NumberInput.looksLikeValidNumber() (lines 41-42, 51-52, 646-657), but the method is not called by any production code within jackson-core itself. As a library (LIB target), jackson-core exports this public API method for external consumers (primarily jackson-databind) but does not route any attacker-controllable input to it through i..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T07:51:55.281190+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T07:51:55.281190+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T07:51:55.281190+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 is fixed in version 2.18.5-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      }
    }
  ]
}