{
  "@id": "urn:uuid:6b644b55-f57f-4981-8543-810d4498ebd2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T05:28:00.095846+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:44:00.186938+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.2.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.2.3 is NOT AFFECTED by CVE-2025-49128. The vulnerable code path (the _appendSourceDesc method that extracts and displays byte array content in exception messages) does not exist in this version. JsonLocation.toString() simply calls _sourceRef.toString() which for byte arrays returns \"[B@hashcode\" with no content disclosure. The vulnerable _appendSourceDesc method was introduced after ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.2.3 is NOT AFFECTED by CVE-2025-49128. The vulnerable code path (the _appendSourceDesc method that extracts and displays byte array content in exception messages) does not exist in this version. JsonLocation.toString() simply calls _sourceRef.toString() which for byte arrays returns \"[B@hashcode\" with no content disclosure. The vulnerable _appendSourceDesc method was introduced after ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:45:00.246667+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.2.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:28:00.095846+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 does not affect version 2.2.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.2.3-tuxcare.1 is NOT affected by CVE-2026-18401. The vulnerability targets the async/non-blocking JSON parser's bypass of maxNumberLength constraints. Version 2.2.3 predates the introduction of both the async parser implementation (introduced in commit 056bf5e1, not present in 2.2.3) and the StreamReadConstraints feature (introduced in later versions). The vulnerable code path does no...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "impact_statement": "not_affected \u2014 Version 2.2.3-tuxcare.1 is NOT affected by CVE-2026-18401. The vulnerability targets the async/non-blocking JSON parser's bypass of maxNumberLength constraints. Version 2.2.3 predates the introduction of both the async parser implementation (introduced in commit 056bf5e1, not present in 2.2.3) and the StreamReadConstraints feature (introduced in later versions). The vulnerable code path does no..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T06:17:00.168492+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.2.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Version 2.2.3 of jackson-core is not affected by CVE-2026-68494. The vulnerability concerns an incomplete fix in the non-blocking async parser (NonBlockingUtf8JsonParserBase.java) where the parser fails to validate integer length before returning NOT_AVAILABLE in streaming scenarios, allowing unbounded memory allocation up to maxStringLength instead of respecting maxNumberLength constraints. Version 2.2.3 predates the introduction of non-blocking parsers entirely and contains only synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser), which the CVE explicitly excludes from its vulnerability scope. The async parser infrastructure was introduced in later versions (2.8.x+), making this vulnerability inapplicable to 2.2.3.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "Version 2.2.3 of jackson-core is not affected by CVE-2026-68494. The vulnerability concerns an incomplete fix in the non-blocking async parser (NonBlockingUtf8JsonParserBase.java) where the parser fails to validate integer length before returning NOT_AVAILABLE in streaming scenarios, allowing unbounded memory allocation up to maxStringLength instead of respecting maxNumberLength constraints. Version 2.2.3 predates the introduction of non-blocking parsers entirely and contains only synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser), which the CVE explicitly excludes from its vulnerability scope. The async parser infrastructure was introduced in later versions (2.8.x+), making this vulnerability inapplicable to 2.2.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:44:00.186938+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.2.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.2.3.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.2.3."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:45:00.246667+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.2.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:44:00.186938+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq does not affect version 2.2.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.2.3 is not affected by GHSA-72hv-8253-57qq. The vulnerability concerns the non-blocking (async) JSON parser bypassing maxNumberLength constraints. Version 2.2.3 (released 2013) predates the introduction of both the async parser infrastructure (added ~2.8) and the StreamReadConstraints validation mechanism (added ~2.15). The vulnerable code path does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "impact_statement": "not_affected \u2014 Version 2.2.3 is not affected by GHSA-72hv-8253-57qq. The vulnerability concerns the non-blocking (async) JSON parser bypassing maxNumberLength constraints. Version 2.2.3 (released 2013) predates the introduction of both the async parser infrastructure (added ~2.8) and the StreamReadConstraints validation mechanism (added ~2.15). The vulnerable code path does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.2.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:44:00.186938+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 does not affect version 2.2.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.2.3 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability exists in NonBlockingUtf8JsonParserBase.java (async/non-blocking parser), which was introduced in Jackson 2.8+ (May 2017). Version 2.2.3 (August 2013) predates the async parser by 4 years and contains only synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser). The affected code path - incremental number parsing ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "impact_statement": "not_affected \u2014 Version 2.2.3 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability exists in NonBlockingUtf8JsonParserBase.java (async/non-blocking parser), which was introduced in Jackson 2.8+ (May 2017). Version 2.2.3 (August 2013) predates the async parser by 4 years and contains only synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser). The affected code path - incremental number parsing ..."
    }
  ]
}