{
  "@id": "urn:uuid:f4a7e035-6535-4373-bea6-4e2a6103775b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T16:54:00.143531+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "action_statement": "Vulnerability CVE-2025-49128 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "action_statement": "Vulnerability CVE-2025-52999 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.11.2 is not affected by CVE-2026-68494. This CVE describes an incomplete fix to StreamReadConstraints.maxNumberLength enforcement in the async parser, specifically targeting versions 2.18.6 and 2.21.1 that had the constraint mechanism with missing validation on streaming paths. Version 2.11.2 predates the StreamReadConstraints feature entirely\u2014the classes StreamReadConstraints, _setIn...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.2 is not affected by CVE-2026-68494. This CVE describes an incomplete fix to StreamReadConstraints.maxNumberLength enforcement in the async parser, specifically targeting versions 2.18.6 and 2.21.1 that had the constraint mechanism with missing validation on streaming paths. Version 2.11.2 predates the StreamReadConstraints feature entirely\u2014the classes StreamReadConstraints, _setIn..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target version 2.11.2 does not contain the vulnerable method NumberInput.looksLikeValidNumber() at all. The method was introduced in jackson-core version 2.17 (confirmed by patch @since annotations and git history). Version 2.11.2, released August 2020, predates this introduction by approximately 6 major/minor releases. Since the entry point does not exist, the ReDoS vulnerability pattern (catastrophic backtracking in PATTERN_FLOAT/PATTERN_FLOAT_TRAILING_DOT regexes) cannot be exploited.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "Target version 2.11.2 does not contain the vulnerable method NumberInput.looksLikeValidNumber() at all. The method was introduced in jackson-core version 2.17 (confirmed by patch @since annotations and git history). Version 2.11.2, released August 2020, predates this introduction by approximately 6 major/minor releases. Since the entry point does not exist, the ReDoS vulnerability pattern (catastrophic backtracking in PATTERN_FLOAT/PATTERN_FLOAT_TRAILING_DOT regexes) cannot be exploited."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "action_statement": "Vulnerability GHSA-72hv-8253-57qq affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:54:00.143531+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.11.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    }
  ]
}