{
  "@id": "urn:uuid:0f4ab28b-5958-473e-915d-6e90e6037f6c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T14:01:40.783847+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.17.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.17.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:01:40.783847+00:00",
      "status_notes": "Vulnerability CVE-2020-28491 does not affect version 2.17.3-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-cbor. The target repository (jackson-dataformats-binary 2.17.3-tuxcare.1) is NOT AFFECTED by CVE-2020-28491. The vulnerability was fixed by the upstream vendor in version 2.11.4 (December 2020), and the target version 2.17.3 already contains the complete fix. The vulnerable pattern (unchecked allocation of byte buffers causing OutOfMemoryError) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0rc1, < 2.11.4; >= 2.12.0rc1, < 2.12.1), NVD (< 2.11.4; > 2.12.0, < 2.12.1; = 2.12.0; = 2.12.0-rc1; = 2.12.0-rc2), cve.org (< 2.11.4; >= 2.12.0-rc1, < 2.12.1), Snyk (>= 0, < 2.11.4; >= 2.12.0-rc1, < 2.12.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-28491"
      },
      "impact_statement": "The target repository (jackson-dataformats-binary 2.17.3-tuxcare.1) is NOT AFFECTED by CVE-2020-28491. The vulnerability was fixed by the upstream vendor in version 2.11.4 (December 2020), and the target version 2.17.3 already contains the complete fix. The vulnerable pattern (unchecked allocation of byte buffers causing OutOfMemoryError) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 2.8.0rc1, < 2.11.4; >= 2.12.0rc1, < 2.12.1), NVD (< 2.11.4; > 2.12.0, < 2.12.1; = 2.12.0; = 2.12.0-rc1; = 2.12.0-rc2), cve.org (< 2.11.4; >= 2.12.0-rc1, < 2.12.1), Snyk (>= 0, < 2.11.4; >= 2.12.0-rc1, < 2.12.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.17.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor@2.17.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T14:01:40.783847+00:00",
      "status_notes": "Vulnerability CVE-2026-106554 affects version 2.17.3-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-cbor.",
      "vulnerability": {
        "name": "CVE-2026-106554"
      },
      "action_statement": "Vulnerability CVE-2026-106554 affects version 2.17.3-tuxcare.2 of com.fasterxml.jackson.dataformat:jackson-dataformat-cbor."
    }
  ]
}