{
  "@id": "urn:uuid:c40a7f33-e6ce-4525-a474-8ac5bddf03a1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T16:46:00.192674+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:46:00.192674+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:46:00.192674+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "action_statement": "Vulnerability CVE-2026-68494 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:46:00.192674+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Version 2.15.3 does not contain the vulnerable code. The looksLikeValidNumber() method and its associated regex patterns PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT were introduced in version 2.17, well after this version was released. The method was added by upstream commit c381325d (Add NumberInput.looksLikeValidNumber() utility method, #1160), first released in 2.17.0, and that commit is not part of this version's history. Exhaustive searches of the codebase found no alternative number validation logic using similar backtracking regex patterns.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "Version 2.15.3 does not contain the vulnerable code. The looksLikeValidNumber() method and its associated regex patterns PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT were introduced in version 2.17, well after this version was released. The method was added by upstream commit c381325d (Add NumberInput.looksLikeValidNumber() utility method, #1160), first released in 2.17.0, and that commit is not part of this version's history. Exhaustive searches of the codebase found no alternative number validation logic using similar backtracking regex patterns."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:46:00.192674+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:46:00.192674+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq is fixed in version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.15.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:46:00.192674+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "action_statement": "Vulnerability GHSA-r7wm-3cxj-wff9 affects version 2.15.3-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    }
  ]
}