{
  "@id": "urn:uuid:87d11d2a-3d92-4782-90b5-b211f1d3f28c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:05:17.011429+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:25:00.104241+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128 is NOT present in jackson-core 2.19.4-tuxcare.1. The vulnerability (information disclosure via incorrect offset handling in exception messages) was fixed in upstream commit a6c29768 (Fix #652) by Tatu Saloranta on April 4, 2021. This fix was already included in the upstream jackson-core 2.19.4 release that TuxCare onboarded (commit c97144fc). The target version contains the corre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-49128 is NOT present in jackson-core 2.19.4-tuxcare.1. The vulnerability (information disclosure via incorrect offset handling in exception messages) was fixed in upstream commit a6c29768 (Fix #652) by Tatu Saloranta on April 4, 2021. This fix was already included in the upstream jackson-core 2.19.4 release that TuxCare onboarded (commit c97144fc). The target version contains the corre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:05:17.011429+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. The target repository (jackson-core 2.19.4-tuxcare.1) is NOT affected by CVE-2025-52999. The vulnerability concerning unbounded nesting depth causing StackOverflowError was fixed in upstream jackson-core 2.15.0 via GitHub PR #943 (commit 54f78a9cff5e3bace1cf8042ac1b4c3785dc9f5e by PJ Fanning). Since version 2.19.4 is newer than 2.15.0, the fix was already present in the upstream release that TuxCare onboarded. The fix adds nesting depth tracking with a configurable limit (default 1000) and throws StreamConstraintsException when the limit is exceeded. All parser implementations use the validation-enabled code paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "The target repository (jackson-core 2.19.4-tuxcare.1) is NOT affected by CVE-2025-52999. The vulnerability concerning unbounded nesting depth causing StackOverflowError was fixed in upstream jackson-core 2.15.0 via GitHub PR #943 (commit 54f78a9cff5e3bace1cf8042ac1b4c3785dc9f5e by PJ Fanning). Since version 2.19.4 is newer than 2.15.0, the fix was already present in the upstream release that TuxCare onboarded. The fix adds nesting depth tracking with a configurable limit (default 1000) and throws StreamConstraintsException when the limit is exceeded. All parser implementations use the validation-enabled code paths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T14:14:32.479263+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 is fixed in version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T14:14:23.886566+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 affects version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "action_statement": "Vulnerability CVE-2026-68494 affects version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T14:14:23.886566+00:00",
      "status_notes": "Vulnerability CVE-2026-68498 affects version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68498"
      },
      "action_statement": "Vulnerability CVE-2026-68498 affects version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T14:14:23.886566+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core 2.19.4 contains the vulnerable ReDoS patterns (PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT with ambiguous quantifiers) in NumberInput.java, but these patterns are only exposed through the public API method looksLikeValidNumber() which is not called from jackson-core's own production code. As a library (LIB target), the vulnerable code path is not reachable from jackson-core's inte...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "not_affected \u2014 jackson-core 2.19.4 contains the vulnerable ReDoS patterns (PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT with ambiguous quantifiers) in NumberInput.java, but these patterns are only exposed through the public API method looksLikeValidNumber() which is not called from jackson-core's own production code. As a library (LIB target), the vulnerable code path is not reachable from jackson-core's inte..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T14:14:32.479263+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T14:14:23.886566+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq affects version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "action_statement": "Vulnerability GHSA-72hv-8253-57qq affects version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.19.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T14:14:23.886566+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.19.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    }
  ]
}