{
  "@id": "urn:uuid:c4f35239-de7f-4c57-8cc0-07de642d61ca",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:08:58.427102+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-01T08:30:02.080649+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.21.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2025-49128 affects jackson-core versions prior to 2.13.0 (released September 30, 2021) where JsonLocation._appendSourceDesc incorrectly extracted exception message snippets from index 0 of byte arrays, ignoring the declared offset parameter. This could expose residual buffer content in pooled/reused buffer scenarios. The target version 2.21.2-tuxcare.1 is based on upstream jackson-core 2.21...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-49128 affects jackson-core versions prior to 2.13.0 (released September 30, 2021) where JsonLocation._appendSourceDesc incorrectly extracted exception message snippets from index 0 of byte arrays, ignoring the declared offset parameter. This could expose residual buffer content in pooled/reused buffer scenarios. The target version 2.21.2-tuxcare.1 is based on upstream jackson-core 2.21..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:58.427102+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 does not affect version 2.21.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. CVE-2025-52999 describes a StackOverflowError vulnerability in jackson-core when parsing deeply nested JSON structures. The fix, which adds a configurable nesting depth limit (default 1000), was introduced in jackson-core 2.15.0 via PR #943 (commit 54f78a9c, March 2023). The target version 2.21.2 is significantly newer than 2.15.0 and already contains this upstream fix. The vulnerable code pattern (unbounded depth parsing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "impact_statement": "CVE-2025-52999 describes a StackOverflowError vulnerability in jackson-core when parsing deeply nested JSON structures. The fix, which adds a configurable nesting depth limit (default 1000), was introduced in jackson-core 2.15.0 via PR #943 (commit 54f78a9c, March 2023). The target version 2.21.2 is significantly newer than 2.15.0 and already contains this upstream fix. The vulnerable code pattern (unbounded depth parsing) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.15.0), cve.org (< 2.15.0), Snyk (< 2.15.0-rc1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:32:00.064074+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 does not affect version 2.21.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The target jackson-core 2.21.2-tuxcare.2 is NOT affected by CVE-2026-18401. The vulnerability (async parser bypassing maxNumberLength constraint) was fixed in upstream commit b0c428e6 by PJ Fanning, which shipped in the upstream jackson-core 2.21.2 release that TuxCare onboarded. The fix adds validation methods (_setIntLength, _setFractLength, _setExpLength) that enforce maxNumberLength constra...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "impact_statement": "not_affected \u2014 The target jackson-core 2.21.2-tuxcare.2 is NOT affected by CVE-2026-18401. The vulnerability (async parser bypassing maxNumberLength constraint) was fixed in upstream commit b0c428e6 by PJ Fanning, which shipped in the upstream jackson-core 2.21.2 release that TuxCare onboarded. The fix adds validation methods (_setIntLength, _setFractLength, _setExpLength) that enforce maxNumberLength constra..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:11:00.169222+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 affects version 2.21.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.21.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "action_statement": "Vulnerability CVE-2026-68494 affects version 2.21.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.21.2-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T08:06:58.747357+00:00",
      "status_notes": "Vulnerability CVE-2026-68498 affects version 2.21.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68498"
      },
      "action_statement": "Vulnerability CVE-2026-68498 affects version 2.21.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T07:11:00.169222+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 affects version 2.21.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.21.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "action_statement": "Vulnerability CVE-2026-89407 affects version 2.21.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core, and is fixed in 2.21.2-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T08:06:58.747357+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.21.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    }
  ]
}