{
  "@id": "urn:uuid:9c16045a-c09d-4de7-8481-dd40516c0513",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T06:19:00.029332+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.11.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.11.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-28491 does not affect version 2.11.4-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-cbor. The target repository jackson-dataformats-binary version 2.11.4-tuxcare.2 is NOT AFFECTED by CVE-2020-28491. The vulnerability (unchecked allocation of byte buffer causing OutOfMemoryError) was fixed in upstream version 2.11.4, which is the version TuxCare onboarded. The fix commit de072d314af8 by upstream author tatu.saloranta@iki.fi is present in HEAD and was already part of the upstream release. The fix introduces a 250KB threshold (LONGEST_NON_CHUNKED_BINARY) and routes larger declared binary lengths to incremental reading (_finishLongContiguousBytes) instead of immediate allocation, preventing OOME from malicious CBOR input with inflated length claims.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0rc1, < 2.11.4; >= 2.12.0rc1, < 2.12.1), NVD (< 2.11.4; > 2.12.0, < 2.12.1; = 2.12.0; = 2.12.0-rc1; = 2.12.0-rc2), cve.org (< 2.11.4; >= 2.12.0-rc1, < 2.12.1), Snyk (>= 0, < 2.11.4; >= 2.12.0-rc1, < 2.12.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-28491"
      },
      "impact_statement": "The target repository jackson-dataformats-binary version 2.11.4-tuxcare.2 is NOT AFFECTED by CVE-2020-28491. The vulnerability (unchecked allocation of byte buffer causing OutOfMemoryError) was fixed in upstream version 2.11.4, which is the version TuxCare onboarded. The fix commit de072d314af8 by upstream author tatu.saloranta@iki.fi is present in HEAD and was already part of the upstream release. The fix introduces a 250KB threshold (LONGEST_NON_CHUNKED_BINARY) and routes larger declared binary lengths to incremental reading (_finishLongContiguousBytes) instead of immediate allocation, preventing OOME from malicious CBOR input with inflated length claims.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0rc1, < 2.11.4; >= 2.12.0rc1, < 2.12.1), NVD (< 2.11.4; > 2.12.0, < 2.12.1; = 2.12.0; = 2.12.0-rc1; = 2.12.0-rc2), cve.org (< 2.11.4; >= 2.12.0-rc1, < 2.12.1), Snyk (>= 0, < 2.11.4; >= 2.12.0-rc1, < 2.12.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.11.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.11.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T06:19:00.029332+00:00",
      "status_notes": "Vulnerability CVE-2026-106554 does not affect version 2.11.4-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-cbor. not_affected \u2014 The target (jackson-dataformats-binary 2.11.4-tuxcare.2) has no TagList and no accumulation of tags. CBORParser keeps one int field, _tagValue, and rejects a second consecutive tag with \"Multiple tags not allowed per value\". An unbounded run of tag bytes therefore fails on the second tag and cannot cause quadratic growth. Type A2 (chain absent).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-106554"
      },
      "impact_statement": "not_affected \u2014 The target (jackson-dataformats-binary 2.11.4-tuxcare.2) has no TagList and no accumulation of tags. CBORParser keeps one int field, _tagValue, and rejects a second consecutive tag with \"Multiple tags not allowed per value\". An unbounded run of tag bytes therefore fails on the second tag and cannot cause quadratic growth. Type A2 (chain absent)."
    }
  ]
}