{
  "@id": "urn:uuid:bb4657af-697a-4569-a98d-85242e0b4bc7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T16:53:00.092164+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "action_statement": "Vulnerability CVE-2025-49128 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      },
      "action_statement": "Vulnerability CVE-2025-52999 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.11.4 is not affected by CVE-2026-68494. This CVE describes an incomplete fix for a number-length constraint bypass in jackson-core 2.18.6 and 2.21.1, where the StreamReadConstraints.maxNumberLength validation can be bypassed via the async parser's streaming path. Version 2.11.4 predates the introduction of StreamReadConstraints entirely (added in commit e95dd282). The CVE specifically...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "not_affected \u2014 Version 2.11.4 is not affected by CVE-2026-68494. This CVE describes an incomplete fix for a number-length constraint bypass in jackson-core 2.18.6 and 2.21.1, where the StreamReadConstraints.maxNumberLength validation can be bypassed via the async parser's streaming path. Version 2.11.4 predates the introduction of StreamReadConstraints entirely (added in commit e95dd282). The CVE specifically..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. jackson-core version 2.11.4 is NOT AFFECTED by CVE-2026-89407. The vulnerable looksLikeValidNumber() method with quadratic regex backtracking was introduced in version 2.17.0 and does not exist in the 2.11.4 codebase. NumberInput in this version contains no regex patterns. The vulnerable mechanism is structurally absent from this older version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "jackson-core version 2.11.4 is NOT AFFECTED by CVE-2026-89407. The vulnerable looksLikeValidNumber() method with quadratic regex backtracking was introduced in version 2.17.0 and does not exist in the 2.11.4 codebase. NumberInput in this version contains no regex patterns. The vulnerable mechanism is structurally absent from this older version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:53:00.092164+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "action_statement": "Vulnerability GHSA-72hv-8253-57qq affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.11.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:52:12.076727+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.11.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    }
  ]
}