{
  "@id": "urn:uuid:825ff220-d54f-49e2-8ab8-a1ce4b788391",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T08:47:00.105397+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:46:00.226716+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:46:00.226716+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:45:00.246667+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target version 2.13.2 does not contain the vulnerable code. The CVE-2026-89407 ReDoS vulnerability exists in `NumberInput.looksLikeValidNumber()` method which uses problematic regex patterns `PATTERN_FLOAT` and `PATTERN_FLOAT_TRAILING_DOT`. These components were introduced in jackson-core version 2.17 (December 2023), but the target version 2.13.2 was released in March 2022, predating the vulnerable feature by 21 months. The method, regex patterns, and attack surface do not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "Target version 2.13.2 does not contain the vulnerable code. The CVE-2026-89407 ReDoS vulnerability exists in `NumberInput.looksLikeValidNumber()` method which uses problematic regex patterns `PATTERN_FLOAT` and `PATTERN_FLOAT_TRAILING_DOT`. These components were introduced in jackson-core version 2.17 (December 2023), but the target version 2.13.2 was released in March 2022, predating the vulnerable feature by 21 months. The method, regex patterns, and attack surface do not exist in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:46:00.226716+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:46:00.226716+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:46:00.226716+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.13.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:47:00.105397+00:00",
      "status_notes": "Vulnerability sonatype-2022-6438 is fixed in version 2.13.2-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "sonatype-2022-6438"
      }
    }
  ]
}