{
  "@id": "urn:uuid:825ff220-d54f-49e2-8ab8-a1ce4b788391",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-01T08:19:33.992425+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:19:33.992425+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The target repository (jackson-core 2.13.2-tuxcare.1) is NOT affected by CVE-2025-49128. The vulnerability was fixed in upstream version 2.13.0 (released September 30, 2021) via commit a6c297682737dde13337cb7c3020f299518609a8, which was authored by upstream maintainer Tatu Saloranta. This fix was already present in the upstream release when TuxCare onboarded version 2.13.2. The vulnerable patte...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 The target repository (jackson-core 2.13.2-tuxcare.1) is NOT affected by CVE-2025-49128. The vulnerability was fixed in upstream version 2.13.0 (released September 30, 2021) via commit a6c297682737dde13337cb7c3020f299518609a8, which was authored by upstream maintainer Tatu Saloranta. This fix was already present in the upstream release when TuxCare onboarded version 2.13.2. The vulnerable patte..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:46:00.226716+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:46:00.226716+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:45:00.246667+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target version 2.13.2 does not contain the vulnerable code. The CVE-2026-89407 ReDoS vulnerability exists in `NumberInput.looksLikeValidNumber()` method which uses problematic regex patterns `PATTERN_FLOAT` and `PATTERN_FLOAT_TRAILING_DOT`. These components were introduced in jackson-core version 2.17 (December 2023), but the target version 2.13.2 was released in March 2022, predating the vulnerable feature by 21 months. The method, regex patterns, and attack surface do not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "Target version 2.13.2 does not contain the vulnerable code. The CVE-2026-89407 ReDoS vulnerability exists in `NumberInput.looksLikeValidNumber()` method which uses problematic regex patterns `PATTERN_FLOAT` and `PATTERN_FLOAT_TRAILING_DOT`. These components were introduced in jackson-core version 2.17 (December 2023), but the target version 2.13.2 was released in March 2022, predating the vulnerable feature by 21 months. The method, regex patterns, and attack surface do not exist in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:46:00.226716+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:46:00.226716+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:46:00.226716+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:47:00.105397+00:00",
      "status_notes": "Vulnerability sonatype-2022-6438 is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "sonatype-2022-6438"
      }
    }
  ]
}