{
  "@id": "urn:uuid:36fa9b65-92da-4e5d-ac51-fd0063a066e3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T05:33:00.179011+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:43:00.155124+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.7.9 is NOT affected by CVE-2025-49128. The vulnerable code pattern (_appendSourceDesc method that reads byte array content from position 0) was introduced between versions 2.8.0 and 2.9.0, after the 2.7.9 release. In 2.7.9, JsonLocation.toString() simply calls _sourceRef.toString() which produces a hash string for byte arrays (e.g., \"[B@1234abcd\"), not the actual content. The CVE's ve...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.7.9 is NOT affected by CVE-2025-49128. The vulnerable code pattern (_appendSourceDesc method that reads byte array content from position 0) was introduced between versions 2.8.0 and 2.9.0, after the 2.7.9 release. In 2.7.9, JsonLocation.toString() simply calls _sourceRef.toString() which produces a hash string for byte arrays (e.g., \"[B@1234abcd\"), not the actual content. The CVE's ve..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:33:00.179011+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.7.9 is not affected by CVE-2026-18401. The vulnerability concerns the async/non-blocking JSON parser bypassing the maxNumberLength constraint. However, version 2.7.9 (released 2016) predates both the async parser feature and the maxNumberLength constraint. The async parser was introduced in later versions (2.8+), and maxNumberLength was added in version 2.15+. Since neither the vulner...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "impact_statement": "not_affected \u2014 Version 2.7.9 is not affected by CVE-2026-18401. The vulnerability concerns the async/non-blocking JSON parser bypassing the maxNumberLength constraint. However, version 2.7.9 (released 2016) predates both the async parser feature and the maxNumberLength constraint. The async parser was introduced in later versions (2.8+), and maxNumberLength was added in version 2.15+. Since neither the vulner..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:43:00.155124+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core 2.7.9 is NOT AFFECTED by CVE-2026-68494. The vulnerability targets an incomplete fix in the async/non-blocking parser's streaming integer-digit path (specifically NonBlockingUtf8JsonParserBase) where maxNumberLength validation was not enforced before returning NOT_AVAILABLE. Version 2.7.9 does not contain any async/non-blocking parser infrastructure - this feature was introduced th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "not_affected \u2014 jackson-core 2.7.9 is NOT AFFECTED by CVE-2026-68494. The vulnerability targets an incomplete fix in the async/non-blocking parser's streaming integer-digit path (specifically NonBlockingUtf8JsonParserBase) where maxNumberLength validation was not enforced before returning NOT_AVAILABLE. Version 2.7.9 does not contain any async/non-blocking parser infrastructure - this feature was introduced th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:43:00.155124+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Version 2.7.9 does not contain the looksLikeValidNumber() method that exhibits the ReDoS vulnerability described in CVE-2026-89407. The vulnerable method was introduced in version 2.17.0 (released March 2024), approximately 7 years after this version was released (February 2017). The target codebase contains no regex-based number validation whatsoever; its number parsing methods use either hand-rolled character-by-character scanning (parseInt, parseLong) or the JDK's Double.parseDouble and BigDecimal constructors (parseDouble, parseBigDecimal), with no regular expressions involved.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "Version 2.7.9 does not contain the looksLikeValidNumber() method that exhibits the ReDoS vulnerability described in CVE-2026-89407. The vulnerable method was introduced in version 2.17.0 (released March 2024), approximately 7 years after this version was released (February 2017). The target codebase contains no regex-based number validation whatsoever; its number parsing methods use either hand-rolled character-by-character scanning (parseInt, parseLong) or the JDK's Double.parseDouble and BigDecimal constructors (parseDouble, parseBigDecimal), with no regular expressions involved."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:43:00.155124+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Jackson-core version 2.7.9 is not affected by GHSA-72hv-8253-57qq. The vulnerability is specific to the async/non-blocking JSON parser (NonBlockingUtf8JsonParserBase) bypassing StreamReadConstraints.maxNumberLength validation. Version 2.7.9 predates the introduction of both the async parser infrastructure (introduced ~v2.8/2.9) and the StreamReadConstraints validation framework. The target vers...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "impact_statement": "not_affected \u2014 Jackson-core version 2.7.9 is not affected by GHSA-72hv-8253-57qq. The vulnerability is specific to the async/non-blocking JSON parser (NonBlockingUtf8JsonParserBase) bypassing StreamReadConstraints.maxNumberLength validation. Version 2.7.9 predates the introduction of both the async parser infrastructure (introduced ~v2.8/2.9) and the StreamReadConstraints validation framework. The target vers..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:43:00.155124+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core 2.7.9 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability concerns incomplete validation in non-blocking async parsers (NonBlockingUtf8JsonParserBase) when they return NOT_AVAILABLE after running out of input mid-number parsing. Version 2.7.9 predates the entire non-blocking parser feature (introduced in 2.8.0). The target has no NonBlockingUtf8JsonParserBase class, no create...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "impact_statement": "not_affected \u2014 jackson-core 2.7.9 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability concerns incomplete validation in non-blocking async parsers (NonBlockingUtf8JsonParserBase) when they return NOT_AVAILABLE after running out of input mid-number parsing. Version 2.7.9 predates the entire non-blocking parser feature (introduced in 2.8.0). The target has no NonBlockingUtf8JsonParserBase class, no create..."
    }
  ]
}