{
  "@id": "urn:uuid:fc7253e0-37b1-4508-abb9-98eac33f6bb8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:08:58.427102+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:28:00.134823+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128: The target jackson-core 2.18.3-tuxcare.2 is NOT AFFECTED. The vulnerability\u2014where exception messages incorrectly read from byte array index 0 instead of the declared offset, potentially exposing residual data from pooled buffers\u2014was fixed by upstream maintainer Tatu Saloranta in commit a6c29768 (April 2021, version 2.13.0). This fix was already present in the upstream 2.18.3 rel...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-49128: The target jackson-core 2.18.3-tuxcare.2 is NOT AFFECTED. The vulnerability\u2014where exception messages incorrectly read from byte array index 0 instead of the declared offset, potentially exposing residual data from pooled buffers\u2014was fixed by upstream maintainer Tatu Saloranta in commit a6c29768 (April 2021, version 2.13.0). This fix was already present in the upstream 2.18.3 rel..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:58.427102+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. The target jackson-core 2.18.3-tuxcare.2 is NOT vulnerable to CVE-2025-52999 (stack overflow from deeply nested JSON). The fix was already present in the upstream 2.18.3 release that TuxCare onboarded. The complete nesting depth defense (StreamReadConstraints with DEFAULT_MAX_DEPTH=1000, validateNestingDepth() validation in all parsers) is fully functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "The target jackson-core 2.18.3-tuxcare.2 is NOT vulnerable to CVE-2025-52999 (stack overflow from deeply nested JSON). The fix was already present in the upstream 2.18.3 release that TuxCare onboarded. The complete nesting depth defense (StreamReadConstraints with DEFAULT_MAX_DEPTH=1000, validateNestingDepth() validation in all parsers) is fully functional in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 affects version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "action_statement": "Vulnerability CVE-2026-68494 affects version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability CVE-2026-68498 affects version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68498"
      },
      "action_statement": "Vulnerability CVE-2026-68498 affects version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 is fixed in version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89407"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:49:04.388800+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 affects version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.18.3-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      },
      "action_statement": "Vulnerability CVE-2026-89425 affects version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.18.3-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.18.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    }
  ]
}