{ "@id": "urn:uuid:f5a88057-a8d7-4b13-8298-ac32cdc00839", "role": "Document Creator", "author": "https://tuxcare.com", "version": 5, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-01T08:21:00.141769+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1" } } ], "timestamp": "2026-11-01T08:21:00.141769+00:00", "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.13.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128 affects jackson-core's handling of byte array offsets in exception messages. The vulnerability was fixed in upstream jackson-core 2.13.0 (released September 30, 2021) via commit a6c29768 by Tatu Saloranta. The target version 2.13.4 includes this fix as it was part of the upstream release that TuxCare onboarded. The vulnerable pattern is not present in the target.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-49128" }, "impact_statement": "not_affected \u2014 CVE-2025-49128 affects jackson-core's handling of byte array offsets in exception messages. The vulnerability was fixed in upstream jackson-core 2.13.0 (released September 30, 2021) via commit a6c29768 by Tatu Saloranta. The target version 2.13.4 includes this fix as it was part of the upstream release that TuxCare onboarded. The vulnerable pattern is not present in the target." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T08:47:00.105397+00:00", "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.13.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2025-52999" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1" } } ], "timestamp": "2026-10-29T01:32:18.351129+00:00", "status_notes": "Vulnerability CVE-2026-18401 affects version 2.13.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2026-18401" }, "action_statement": "Vulnerability CVE-2026-18401 affects version 2.13.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T08:47:00.105397+00:00", "status_notes": "Vulnerability CVE-2026-68494 is fixed in version 2.13.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2026-68494" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T08:45:00.246667+00:00", "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.13.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Version 2.13.4 is not affected by CVE-2026-89407. The vulnerable `NumberInput.looksLikeValidNumber()` method and its problematic regex patterns (`PATTERN_FLOAT`, `PATTERN_FLOAT_TRAILING_DOT`) do not exist in this version. The method was introduced later in version 2.17.x (December 2023), more than a year after 2.13.4 was released (September 2022). This version predates the vulnerable feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-89407" }, "impact_statement": "Version 2.13.4 is not affected by CVE-2026-89407. The vulnerable `NumberInput.looksLikeValidNumber()` method and its problematic regex patterns (`PATTERN_FLOAT`, `PATTERN_FLOAT_TRAILING_DOT`) do not exist in this version. The method was introduced later in version 2.17.x (December 2023), more than a year after 2.13.4 was released (September 2022). This version predates the vulnerable feature entirely." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T08:47:00.105397+00:00", "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.13.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2026-89425" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T08:47:00.105397+00:00", "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.13.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "GHSA-72hv-8253-57qq" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T08:47:00.105397+00:00", "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 is fixed in version 2.13.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "GHSA-r7wm-3cxj-wff9" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.4-tuxcare.1" } } ], "timestamp": "2026-10-19T08:47:00.105397+00:00", "status_notes": "Vulnerability sonatype-2022-6438 is fixed in version 2.13.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "sonatype-2022-6438" } } ] }