{
  "@id": "urn:uuid:f9791324-fed6-44a2-ace9-9af4b52c5625",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:06:46.571739+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:25:57.102552+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128 is NOT present in jackson-core 2.18.8-tuxcare.2. The vulnerability (incorrect offset handling in JsonLocation exception message generation, leading to information disclosure of up to 500 bytes from pooled buffers) was fixed by upstream vendor in commit a6c297682737dde13337cb7c3020f299518609a8 (\"Fix #652\") on April 4, 2021, released in jackson-core 2.13.0. This fix shipped with th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-49128 is NOT present in jackson-core 2.18.8-tuxcare.2. The vulnerability (incorrect offset handling in JsonLocation exception message generation, leading to information disclosure of up to 500 bytes from pooled buffers) was fixed by upstream vendor in commit a6c297682737dde13337cb7c3020f299518609a8 (\"Fix #652\") on April 4, 2021, released in jackson-core 2.13.0. This fix shipped with th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:46.571739+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target jackson-core 2.18.8 is not affected by CVE-2025-52999 (stack overflow from deeply nested JSON). The nesting depth validation fix was introduced in upstream 2.15.0 (March 2023, PR #943) and shipped in upstream release 2.18.8 before TuxCare onboarded it. The fix is fully present: StreamReadConstraints.validateNestingDepth() enforces a default 1000-level depth limit, ParserBase wrapper methods call validation on every array/object scope entry, and JsonReadContext tracks nesting depth. Fix authored by upstream contributor PJ Fanning, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "Target jackson-core 2.18.8 is not affected by CVE-2025-52999 (stack overflow from deeply nested JSON). The nesting depth validation fix was introduced in upstream 2.15.0 (March 2023, PR #943) and shipped in upstream release 2.18.8 before TuxCare onboarded it. The fix is fully present: StreamReadConstraints.validateNestingDepth() enforces a default 1000-level depth limit, ParserBase wrapper methods call validation on every array/object scope entry, and JsonReadContext tracks nesting depth. Fix authored by upstream contributor PJ Fanning, not TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:29:48.013272+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The target repository jackson-core 2.18.8-tuxcare.2 is not vulnerable to CVE-2026-18401. The upstream fix (commit b0c428e6) that enforces maxNumberLength validation in the async parser was already included in the upstream 2.18.8 release before TuxCare onboarded it. The fix adds three validation methods (_setIntLength, _setFractLength, _setExpLength) that call validateIntegerLength() and validat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "impact_statement": "not_affected \u2014 The target repository jackson-core 2.18.8-tuxcare.2 is not vulnerable to CVE-2026-18401. The upstream fix (commit b0c428e6) that enforces maxNumberLength validation in the async parser was already included in the upstream 2.18.8 release before TuxCare onboarded it. The fix adds three validation methods (_setIntLength, _setFractLength, _setExpLength) that call validateIntegerLength() and validat..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:58:46.516698+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target jackson-core 2.18.8 is not affected by CVE-2026-68494. The vulnerability (incomplete number-length validation in async parser's streaming integer path allowing memory exhaustion) was fixed in upstream commit 4cdd529749 by tonghuaroot@gmail.com on 2026-05-21, before the 2.18.8 release on 2026-05-28. The fix added _setIntLength validation calls at 4 NOT_AVAILABLE return sites (lines 1328, 1394, 1467, 1703). TuxCare onboarded an already-fixed version on 2026-10-16.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.18.8; >= 2.19.0, < 2.21.4), cve.org (>= 2.15.0, < 2.18.8; >= 2.19.0, < 2.21.4), Snyk (< 2.18.8; >= 2.19.0-rc1, < 2.21.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "Target jackson-core 2.18.8 is not affected by CVE-2026-68494. The vulnerability (incomplete number-length validation in async parser's streaming integer path allowing memory exhaustion) was fixed in upstream commit 4cdd529749 by tonghuaroot@gmail.com on 2026-05-21, before the 2.18.8 release on 2026-05-28. The fix added _setIntLength validation calls at 4 NOT_AVAILABLE return sites (lines 1328, 1394, 1467, 1703). TuxCare onboarded an already-fixed version on 2026-10-16.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.18.8; >= 2.19.0, < 2.21.4), cve.org (>= 2.15.0, < 2.18.8; >= 2.19.0, < 2.21.4), Snyk (< 2.18.8; >= 2.19.0-rc1, < 2.21.4)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability CVE-2026-68498 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68498"
      },
      "action_statement": "Vulnerability CVE-2026-68498 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 is fixed in version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89407"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T08:06:58.747357+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.18.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      },
      "action_statement": "Vulnerability CVE-2026-89425 affects version 2.18.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.18.8-tuxcare.2."
    }
  ]
}