{
  "@id": "urn:uuid:4363180a-3ba7-4318-b38e-1379ad99c4bf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-22T08:52:48.336079+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T13:35:07.633587+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.1.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.1.3 is NOT AFFECTED by CVE-2025-49128. The vulnerability exists in jackson-core's content snippet extraction feature that displays up to 500 bytes of source content in exception messages. When parsing from a byte array with an offset, versions 2.9.0 through 2.12.x incorrectly extracted content from index 0 instead of the declared offset, potentially leaking pooled buffer content. Howe...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.1.3 is NOT AFFECTED by CVE-2025-49128. The vulnerability exists in jackson-core's content snippet extraction feature that displays up to 500 bytes of source content in exception messages. When parsing from a byte array with an offset, versions 2.9.0 through 2.12.x incorrectly extracted content from index 0 instead of the declared offset, potentially leaking pooled buffer content. Howe..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T13:35:07.633587+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.1.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T06:17:00.168492+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.1.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Version 2.1.3 does not have CVE-2026-68494. The vulnerability requires the async/non-blocking parser infrastructure (NonBlockingUtf8JsonParserBase, ByteArrayFeeder, createNonBlockingByteArrayParser factory methods, and the NOT_AVAILABLE token suspension mechanism) that was introduced in jackson-core 2.9 (circa 2017). Version 2.1.3 (circa 2012-2013) only contains synchronous parsers (ReaderBasedJsonParser, UTF8StreamJsonParser) with blocking I/O, which cannot exhibit the CVE's attack pattern. The CVE explicitly targets the async parser's streaming suspension path where \"ran out of input while still inside MINOR_NUMBER_INTEGER_DIGITS, return NOT_AVAILABLE to caller\" - this code path does not exist in version 2.1.3. TuxCare has backported the fix to versions 2.14.1, 2.14.2, 2.17.1, 2.17.2, and 2.17.3, but not to 2.1.3, confirming that 2.1.3 lacks the vulnerable code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "Version 2.1.3 does not have CVE-2026-68494. The vulnerability requires the async/non-blocking parser infrastructure (NonBlockingUtf8JsonParserBase, ByteArrayFeeder, createNonBlockingByteArrayParser factory methods, and the NOT_AVAILABLE token suspension mechanism) that was introduced in jackson-core 2.9 (circa 2017). Version 2.1.3 (circa 2012-2013) only contains synchronous parsers (ReaderBasedJsonParser, UTF8StreamJsonParser) with blocking I/O, which cannot exhibit the CVE's attack pattern. The CVE explicitly targets the async parser's streaming suspension path where \"ran out of input while still inside MINOR_NUMBER_INTEGER_DIGITS, return NOT_AVAILABLE to caller\" - this code path does not exist in version 2.1.3. TuxCare has backported the fix to versions 2.14.1, 2.14.2, 2.17.1, 2.17.2, and 2.17.3, but not to 2.1.3, confirming that 2.1.3 lacks the vulnerable code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T08:52:48.336079+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.1.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Version 2.1.3 is not affected by CVE-2026-89407. The vulnerable regex-based validation code (`looksLikeValidNumber()` method with `PATTERN_FLOAT` regex causing quadratic backtracking) was introduced in jackson-core version 2.17 (December 2023), approximately 11 years after version 2.1.3 was released. Version 2.1.3 uses only linear-time character scanning for all number parsing operations and never contained the problematic regex patterns described in the CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "Version 2.1.3 is not affected by CVE-2026-89407. The vulnerable regex-based validation code (`looksLikeValidNumber()` method with `PATTERN_FLOAT` regex causing quadratic backtracking) was introduced in jackson-core version 2.17 (December 2023), approximately 11 years after version 2.1.3 was released. Version 2.1.3 uses only linear-time character scanning for all number parsing operations and never contained the problematic regex patterns described in the CVE."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T13:36:00.096945+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.1.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T13:35:07.633587+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq does not affect version 2.1.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.1.3 is not affected by GHSA-72hv-8253-57qq. The vulnerability concerns the async/non-blocking JSON parser (NonBlockingUtf8JsonParserBase) bypassing maxNumberLength constraints. This parser was introduced in jackson-core 2.9.0 (September 2017), while version 2.1.3 was released in January 2013\u20144 years before the vulnerable code path existed. Version 2.1.3 contains only synchronous parse...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "impact_statement": "not_affected \u2014 Version 2.1.3 is not affected by GHSA-72hv-8253-57qq. The vulnerability concerns the async/non-blocking JSON parser (NonBlockingUtf8JsonParserBase) bypassing maxNumberLength constraints. This parser was introduced in jackson-core 2.9.0 (September 2017), while version 2.1.3 was released in January 2013\u20144 years before the vulnerable code path existed. Version 2.1.3 contains only synchronous parse..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.1.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T13:35:07.633587+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 does not affect version 2.1.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.1.3 does not contain the vulnerable async parser architecture. GHSA-r7wm-3cxj-wff9 affects `NonBlockingUtf8JsonParserBase.java` (async parser with streaming NOT_AVAILABLE returns), introduced in Jackson 2.9. Version 2.1.3 (circa 2013) only has synchronous blocking parsers (`UTF8StreamJsonParser`, `ReaderBasedJsonParser`), which the CVE explicitly excludes: \"The synchronous parsers are...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "impact_statement": "not_affected \u2014 Version 2.1.3 does not contain the vulnerable async parser architecture. GHSA-r7wm-3cxj-wff9 affects `NonBlockingUtf8JsonParserBase.java` (async parser with streaming NOT_AVAILABLE returns), introduced in Jackson 2.9. Version 2.1.3 (circa 2013) only has synchronous blocking parsers (`UTF8StreamJsonParser`, `ReaderBasedJsonParser`), which the CVE explicitly excludes: \"The synchronous parsers are..."
    }
  ]
}