{
  "@id": "urn:uuid:36316313-a392-4c43-8801-c5d247024a3b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:06:46.571739+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:29:00.122240+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.20.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Target version 2.20.1 is NOT affected by CVE-2025-49128. The vulnerability (reading from index 0 instead of respecting offset/length parameters in exception messages) was fixed in jackson-core 2.13.0 (April 2021) via commit a6c29768. This upstream fix was already present in the 2.20.1 release that TuxCare onboarded. The target's ContentReference.appendSourceDescription() correctly retrieves con...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Target version 2.20.1 is NOT affected by CVE-2025-49128. The vulnerability (reading from index 0 instead of respecting offset/length parameters in exception messages) was fixed in jackson-core 2.13.0 (April 2021) via commit a6c29768. This upstream fix was already present in the 2.20.1 release that TuxCare onboarded. The target's ContentReference.appendSourceDescription() correctly retrieves con..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:06:46.571739+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.20.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. The target repository (jackson-core 2.20.1-tuxcare.1) is not affected by CVE-2025-52999. The vulnerability fix was already included in the upstream jackson-core 2.15.0 release and is present in version 2.20.1. The fix implements nesting depth tracking and validation (default limit 1000) to prevent stack overflow from deeply nested JSON structures. Fix commit 54f78a9c by upstream author PJ Fanning was shipped in the upstream 2.20.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "The target repository (jackson-core 2.20.1-tuxcare.1) is not affected by CVE-2025-52999. The vulnerability fix was already included in the upstream jackson-core 2.15.0 release and is present in version 2.20.1. The fix implements nesting depth tracking and validation (default limit 1000) to prevent stack overflow from deeply nested JSON structures. Fix commit 54f78a9c by upstream author PJ Fanning was shipped in the upstream 2.20.1 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:15:05.610606+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 is fixed in version 2.20.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:15:05.610606+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 is fixed in version 2.20.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:15:05.610606+00:00",
      "status_notes": "Vulnerability CVE-2026-68498 affects version 2.20.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68498"
      },
      "action_statement": "Vulnerability CVE-2026-68498 affects version 2.20.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:15:05.610606+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 is fixed in version 2.20.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89407"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:15:05.610606+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.20.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:15:05.610606+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.20.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.20.1-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T07:15:05.610606+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 is fixed in version 2.20.1-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      }
    }
  ]
}