{
  "@id": "urn:uuid:138e1f88-d0e0-4859-9437-e9ef1d57b52f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T11:59:58.922832+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-01T08:19:33.992425+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.15.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Target version 2.15.2-tuxcare.2 is NOT vulnerable to CVE-2025-49128. The vulnerability (information disclosure via incorrect offset handling in exception messages) was already fixed in upstream jackson-core version 2.15.2, which was onboarded by TuxCare. The fix (commit a6c29768) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare's onboarding. ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Target version 2.15.2-tuxcare.2 is NOT vulnerable to CVE-2025-49128. The vulnerability (information disclosure via incorrect offset handling in exception messages) was already fixed in upstream jackson-core version 2.15.2, which was onboarded by TuxCare. The fix (commit a6c29768) was authored by upstream maintainer Tatu Saloranta and shipped in the upstream release before TuxCare's onboarding. ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T11:59:58.922832+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.15.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-core. The target jackson-core version 2.15.2-tuxcare.2 is NOT AFFECTED by CVE-2025-52999. The vulnerability (unbounded nesting depth causing StackOverflowError) was fixed in upstream jackson-core 2.15.0 via PR #943. The fix introduced configurable nesting depth limits (default 1000) with validation that throws StreamConstraintsException when exceeded. This fix was already present in the upstream release 2.15.0 that predates the target version 2.15.2, which TuxCare onboarded. All key defense components are verified present and active: StreamReadConstraints.validateNestingDepth(), JsonStreamContext._nestingDepth tracking, JsonReadContext initialization, ParserBase helper methods, and parser implementations using validated context creation. The vulnerable code pattern (unbounded recursion) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "The target jackson-core version 2.15.2-tuxcare.2 is NOT AFFECTED by CVE-2025-52999. The vulnerability (unbounded nesting depth causing StackOverflowError) was fixed in upstream jackson-core 2.15.0 via PR #943. The fix introduced configurable nesting depth limits (default 1000) with validation that throws StreamConstraintsException when exceeded. This fix was already present in the upstream release 2.15.0 that predates the target version 2.15.2, which TuxCare onboarded. All key defense components are verified present and active: StreamReadConstraints.validateNestingDepth(), JsonStreamContext._nestingDepth tracking, JsonReadContext initialization, ParserBase helper methods, and parser implementations using validated context creation. The vulnerable code pattern (unbounded recursion) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T14:04:44.916297+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.15.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.15.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T14:04:59.843144+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 is fixed in version 2.15.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T14:04:44.916297+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.15.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-core. Version 2.15.2 is not affected by CVE-2026-89407. The vulnerable code (NumberInput.looksLikeValidNumber() method with quadratic regex patterns) was introduced 6 months after 2.15.2 was released. The method was added on December 9, 2023 (commit c381325d), while version 2.15.2 was released on May 30, 2023. Exhaustive analysis confirms no regex-based number validation exists in 2.15.2, and all parsing uses linear-time character scanning.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "Version 2.15.2 is not affected by CVE-2026-89407. The vulnerable code (NumberInput.looksLikeValidNumber() method with quadratic regex patterns) was introduced 6 months after 2.15.2 was released. The method was added on December 9, 2023 (commit c381325d), while version 2.15.2 was released on May 30, 2023. Exhaustive analysis confirms no regex-based number validation exists in 2.15.2, and all parsing uses linear-time character scanning."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T14:04:44.916297+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.15.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T14:04:44.916297+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.15.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.2-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T14:04:44.916297+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.15.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.15.2-tuxcare.2 of com.fasterxml.jackson.core:jackson-core."
    }
  ]
}