{
  "@id": "urn:uuid:e472f429-7cbb-423a-b108-a6ba19ce28f2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T05:34:00.206704+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.7.8 is NOT AFFECTED by CVE-2025-49128. The vulnerable code path (JsonLocation._appendSourceDesc method with byte array content snippet extraction) does not exist in this version. The method was introduced in version 2.9.0 (May 2017), after 2.7.8 (Sep 2016). The CVE's stated affected range \"2.0.0 to 2.13.0\" is inaccurate; the actual vulnerable range is 2.9.0 to 2.12.x.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.7.8 is NOT AFFECTED by CVE-2025-49128. The vulnerable code path (JsonLocation._appendSourceDesc method with byte array content snippet extraction) does not exist in this version. The method was introduced in version 2.9.0 (May 2017), after 2.7.8 (Sep 2016). The CVE's stated affected range \"2.0.0 to 2.13.0\" is inaccurate; the actual vulnerable range is 2.9.0 to 2.12.x."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T05:34:00.206704+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 does not affect version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core 2.7.8 is not affected by CVE-2026-18401. The vulnerability specifically concerns the async/non-blocking parser bypassing the maxNumberLength constraint in StreamReadConstraints. In version 2.7.8 (released 2016-09-26): (1) The async/non-blocking parser classes (NonBlockingUtf8JsonParserBase, NonBlockingByteArrayJsonParser) do not exist - this feature was introduced 8 months later on...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "impact_statement": "not_affected \u2014 jackson-core 2.7.8 is not affected by CVE-2026-18401. The vulnerability specifically concerns the async/non-blocking parser bypassing the maxNumberLength constraint in StreamReadConstraints. In version 2.7.8 (released 2016-09-26): (1) The async/non-blocking parser classes (NonBlockingUtf8JsonParserBase, NonBlockingByteArrayJsonParser) do not exist - this feature was introduced 8 months later on..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. CVE-2026-68494 (GHSA-r7wm-3cxj-wff9, incomplete fix of GHSA-72hv-8253-57qq) is limited to the non-blocking async parser com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java: its integer-digit paths return NOT_AVAILABLE without validateIntegerLength (fix 050b4298, PR #1611); the synchronous parsers are explicitly not affected. The async parser first shipped in jackson-core 2.9.0; in tuxcare-current/2.7.8 (48328d77) the json/async package does not exist, there are no NonBlockingUtf8JsonParserBase/ByteArrayFeeder/createNonBlocking* symbols (blob search, positive control UTF8StreamJsonParser found), and JsonFactory exposes only blocking createParser methods. The vulnerable code is not present in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "CVE-2026-68494 (GHSA-r7wm-3cxj-wff9, incomplete fix of GHSA-72hv-8253-57qq) is limited to the non-blocking async parser com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java: its integer-digit paths return NOT_AVAILABLE without validateIntegerLength (fix 050b4298, PR #1611); the synchronous parsers are explicitly not affected. The async parser first shipped in jackson-core 2.9.0; in tuxcare-current/2.7.8 (48328d77) the json/async package does not exist, there are no NonBlockingUtf8JsonParserBase/ByteArrayFeeder/createNonBlocking* symbols (blob search, positive control UTF8StreamJsonParser found), and JsonFactory exposes only blocking createParser methods. The vulnerable code is not present in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.7.8.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.7.8."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    }
  ]
}