{ "@id": "urn:uuid:461ce7fd-faa7-45a8-8b5e-d25967ebfa52", "role": "Document Creator", "author": "https://tuxcare.com", "version": 7, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-03T12:06:05.431502+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1" } } ], "timestamp": "2026-11-01T08:27:00.109784+00:00", "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.21.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Target version 2.21.4-tuxcare.1 is NOT AFFECTED by CVE-2025-49128. The vulnerability (information disclosure via incorrect offset handling in exception messages) was fixed in upstream Jackson-core commit a6c297682737dde13337cb7c3020f299518609a8 (April 4, 2021) by Tatu Saloranta. This fix was already present in upstream version 2.21.4 when TuxCare onboarded it (commit 88c9d46a, \"Onboard version ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-49128" }, "impact_statement": "not_affected \u2014 Target version 2.21.4-tuxcare.1 is NOT AFFECTED by CVE-2025-49128. The vulnerability (information disclosure via incorrect offset handling in exception messages) was fixed in upstream Jackson-core commit a6c297682737dde13337cb7c3020f299518609a8 (April 4, 2021) by Tatu Saloranta. This fix was already present in upstream version 2.21.4 when TuxCare onboarded it (commit 88c9d46a, \"Onboard version ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1" } } ], "timestamp": "2026-11-03T12:06:05.431502+00:00", "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.21.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. The target repository jackson-core 2.21.4-tuxcare.1 is NOT affected by CVE-2025-52999. The vulnerability (unbounded nesting depth leading to StackOverflowError) has been fixed by upstream commit 54f78a9c (\"apply constraint to nesting depth #943\"), which was already included in the upstream release 2.21.4 before TuxCare onboarded it. The fix adds nesting depth validation (default max 1000) that throws StreamConstraintsException when exceeded, preventing stack overflow from deeply nested JSON.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52999" }, "impact_statement": "The target repository jackson-core 2.21.4-tuxcare.1 is NOT affected by CVE-2025-52999. The vulnerability (unbounded nesting depth leading to StackOverflowError) has been fixed by upstream commit 54f78a9c (\"apply constraint to nesting depth #943\"), which was already included in the upstream release 2.21.4 before TuxCare onboarded it. The fix adds nesting depth validation (default max 1000) that throws StreamConstraintsException when exceeded, preventing stack overflow from deeply nested JSON.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1" } } ], "timestamp": "2026-11-03T05:31:25.221043+00:00", "status_notes": "Vulnerability CVE-2026-18401 does not affect version 2.21.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The target jackson-core 2.21.4-tuxcare.1 is NOT AFFECTED by CVE-2026-18401. The vulnerability describes async JSON parser bypassing maxNumberLength constraint, allowing arbitrarily long numbers that cause memory/CPU exhaustion. The upstream fix (commit b0c428e6) that adds validation methods (_setIntLength, _setFractLength, _setExpLength) is already present in the target. This fix was shipped in...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-18401" }, "impact_statement": "not_affected \u2014 The target jackson-core 2.21.4-tuxcare.1 is NOT AFFECTED by CVE-2026-18401. The vulnerability describes async JSON parser bypassing maxNumberLength constraint, allowing arbitrarily long numbers that cause memory/CPU exhaustion. The upstream fix (commit b0c428e6) that adds validation methods (_setIntLength, _setFractLength, _setExpLength) is already present in the target. This fix was shipped in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1" } } ], "timestamp": "2026-11-03T11:58:00.062525+00:00", "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.21.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target version 2.21.4-tuxcare.1 contains the upstream fix for CVE-2026-68494 (#1611) which was released in jackson-core 2.21.4 on 28-May-2026. The fix adds `_setIntLength()` validation calls before returning NOT_AVAILABLE during async integer parsing, preventing unbounded buffer growth when streaming digit-only chunks. The vulnerable code pattern (missing validation on streaming integer paths) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.18.8; >= 2.19.0, < 2.21.4), cve.org (>= 2.15.0, < 2.18.8; >= 2.19.0, < 2.21.4), Snyk (< 2.18.8; >= 2.19.0-rc1, < 2.21.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-68494" }, "impact_statement": "Target version 2.21.4-tuxcare.1 contains the upstream fix for CVE-2026-68494 (#1611) which was released in jackson-core 2.21.4 on 28-May-2026. The fix adds `_setIntLength()` validation calls before returning NOT_AVAILABLE during async integer parsing, preventing unbounded buffer growth when streaming digit-only chunks. The vulnerable code pattern (missing validation on streaming integer paths) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.18.8; >= 2.19.0, < 2.21.4), cve.org (>= 2.15.0, < 2.18.8; >= 2.19.0, < 2.21.4), Snyk (< 2.18.8; >= 2.19.0-rc1, < 2.21.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1" } } ], "timestamp": "2026-10-19T16:52:12.076727+00:00", "status_notes": "Vulnerability CVE-2026-68498 affects version 2.21.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2026-68498" }, "action_statement": "Vulnerability CVE-2026-68498 affects version 2.21.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1" } } ], "timestamp": "2026-10-19T16:52:12.076727+00:00", "status_notes": "Vulnerability CVE-2026-89407 is fixed in version 2.21.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2026-89407" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.4-tuxcare.1" } } ], "timestamp": "2026-10-19T16:52:12.076727+00:00", "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.21.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2026-89425" } } ] }