{ "@id": "urn:uuid:c40a7f33-e6ce-4525-a474-8ac5bddf03a1", "role": "Document Creator", "author": "https://tuxcare.com", "version": 5, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-03T12:02:01.158878+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1" } } ], "timestamp": "2026-11-01T08:25:00.104241+00:00", "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128 affects Jackson-core versions prior to 2.13.0 where JsonLocation exception messages incorrectly read byte arrays from index 0 instead of respecting the offset parameter, potentially leaking residual data from pooled buffers. The target repository (jackson-core 2.15.3-tuxcare.2) contains the upstream fix from commit a6c297682737dde13337cb7c3020f299518609a8 (authored by Tatu Salora...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-49128" }, "impact_statement": "not_affected \u2014 CVE-2025-49128 affects Jackson-core versions prior to 2.13.0 where JsonLocation exception messages incorrectly read byte arrays from index 0 instead of respecting the offset parameter, potentially leaking residual data from pooled buffers. The target repository (jackson-core 2.15.3-tuxcare.2) contains the upstream fix from commit a6c297682737dde13337cb7c3020f299518609a8 (authored by Tatu Salora..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1" } } ], "timestamp": "2026-11-03T12:02:01.158878+00:00", "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. The target jackson-core 2.15.3 is not affected by CVE-2025-52999 (deep nesting StackOverflowError). The fix - StreamReadConstraints with configurable nesting depth limit (DEFAULT_MAX_DEPTH=1000) - was introduced in upstream jackson-core 2.15.0 and is present in the 2.15.3 release that TuxCare onboarded. The vulnerable pattern (unbounded nesting without depth validation) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-52999" }, "impact_statement": "The target jackson-core 2.15.3 is not affected by CVE-2025-52999 (deep nesting StackOverflowError). The fix - StreamReadConstraints with configurable nesting depth limit (DEFAULT_MAX_DEPTH=1000) - was introduced in upstream jackson-core 2.15.0 and is present in the 2.15.3 release that TuxCare onboarded. The vulnerable pattern (unbounded nesting without depth validation) does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1" } } ], "timestamp": "2026-10-19T16:46:00.192674+00:00", "status_notes": "Vulnerability CVE-2026-18401 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2026-18401" }, "action_statement": "Vulnerability CVE-2026-18401 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1" } } ], "timestamp": "2026-10-28T14:10:12.324133+00:00", "status_notes": "Vulnerability CVE-2026-68494 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.15.3-tuxcare.2.", "vulnerability": { "name": "CVE-2026-68494" }, "action_statement": "Vulnerability CVE-2026-68494 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.15.3-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1" } } ], "timestamp": "2026-10-19T16:46:00.192674+00:00", "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Version 2.15.3 does not contain the vulnerable code. The looksLikeValidNumber() method and its associated regex patterns PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT were introduced in version 2.17, well after this version was released. The method was added by upstream commit c381325d (Add NumberInput.looksLikeValidNumber() utility method, #1160), first released in 2.17.0, and that commit is not part of this version's history. Exhaustive searches of the codebase found no alternative number validation logic using similar backtracking regex patterns.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-89407" }, "impact_statement": "Version 2.15.3 does not contain the vulnerable code. The looksLikeValidNumber() method and its associated regex patterns PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT were introduced in version 2.17, well after this version was released. The method was added by upstream commit c381325d (Add NumberInput.looksLikeValidNumber() utility method, #1160), first released in 2.17.0, and that commit is not part of this version's history. Exhaustive searches of the codebase found no alternative number validation logic using similar backtracking regex patterns." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1" } } ], "timestamp": "2026-10-19T16:46:00.192674+00:00", "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2026-89425" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1" } } ], "timestamp": "2026-10-19T16:46:00.192674+00:00", "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "GHSA-72hv-8253-57qq" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1" } } ], "timestamp": "2026-10-19T16:46:00.192674+00:00", "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "GHSA-r7wm-3cxj-wff9" }, "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core." } ] }