{ "@id": "urn:uuid:1cec9ab7-54ea-47cc-85af-ce3af69cee72", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-19T18:33:00.225308+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1" } } ], "timestamp": "2026-10-19T18:33:00.225308+00:00", "status_notes": "Vulnerability CVE-2025-49128 affects version 2.4.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2025-49128" }, "action_statement": "Vulnerability CVE-2025-49128 affects version 2.4.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1" } } ], "timestamp": "2026-10-19T18:33:00.225308+00:00", "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.4.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2025-52999" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1" } } ], "timestamp": "2026-10-19T18:33:00.225308+00:00", "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.4.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 CVE-2026-68494 affects the non-blocking async parser (NonBlockingUtf8JsonParserBase) which validates integer length on value completion but not on streaming NOT_AVAILABLE returns. Jackson-core 2.4.0 was released in 2014, predating the introduction of non-blocking parsers in version 2.9.0 (2017). The vulnerable code path does not exist in this version. Only synchronous parsers (UTF8StreamJsonPar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-68494" }, "impact_statement": "not_affected \u2014 CVE-2026-68494 affects the non-blocking async parser (NonBlockingUtf8JsonParserBase) which validates integer length on value completion but not on streaming NOT_AVAILABLE returns. Jackson-core 2.4.0 was released in 2014, predating the introduction of non-blocking parsers in version 2.9.0 (2017). The vulnerable code path does not exist in this version. Only synchronous parsers (UTF8StreamJsonPar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1" } } ], "timestamp": "2026-10-19T18:33:00.225308+00:00", "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.4.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Target version jackson-core 2.4.0 is NOT AFFECTED by CVE-2026-89407. The vulnerable method `NumberInput.looksLikeValidNumber()` does not exist in this version \u2014 it was introduced 9 years later in version 2.17 (December 2023). Version 2.4.0 (released May 2014) uses only hand-written linear-time character scanning for number parsing, with no regex Pattern usage. The vulnerable code path (quadratic-backtracking regex validation) is absent from the entire codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-89407" }, "impact_statement": "Target version jackson-core 2.4.0 is NOT AFFECTED by CVE-2026-89407. The vulnerable method `NumberInput.looksLikeValidNumber()` does not exist in this version \u2014 it was introduced 9 years later in version 2.17 (December 2023). Version 2.4.0 (released May 2014) uses only hand-written linear-time character scanning for number parsing, with no regex Pattern usage. The vulnerable code path (quadratic-backtracking regex validation) is absent from the entire codebase." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1" } } ], "timestamp": "2026-10-19T18:33:00.225308+00:00", "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.4.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "CVE-2026-89425" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1" } } ], "timestamp": "2026-10-19T18:33:00.225308+00:00", "status_notes": "Vulnerability GHSA-72hv-8253-57qq does not affect version 2.4.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core version 2.4.0 is NOT affected by GHSA-72hv-8253-57qq. This vulnerability concerns the non-blocking (async) JSON parser API bypassing maxNumberLength constraints, but version 2.4.0 does not contain any async/non-blocking parser implementation. Async parsers were first introduced to jackson-core in June 2017 (commit ceaa754c), three years after version 2.4.0 was released in May 2014....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-72hv-8253-57qq" }, "impact_statement": "not_affected \u2014 jackson-core version 2.4.0 is NOT affected by GHSA-72hv-8253-57qq. This vulnerability concerns the non-blocking (async) JSON parser API bypassing maxNumberLength constraints, but version 2.4.0 does not contain any async/non-blocking parser implementation. Async parsers were first introduced to jackson-core in June 2017 (commit ceaa754c), three years after version 2.4.0 was released in May 2014...." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1" } } ], "timestamp": "2026-10-19T18:33:00.225308+00:00", "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 does not affect version 2.4.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.4.0 (released May 2014) does not contain the async/non-blocking parser infrastructure that this CVE targets. GHSA-r7wm-3cxj-wff9 specifically affects the incomplete fix in NonBlockingUtf8JsonParserBase in versions 2.18.6 and 2.21.1. Version 2.4.0 predates the async parser implementation by approximately 10 years and lacks all related components (NonBlockingUtf8JsonParserBase class, cr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-r7wm-3cxj-wff9" }, "impact_statement": "not_affected \u2014 Version 2.4.0 (released May 2014) does not contain the async/non-blocking parser infrastructure that this CVE targets. GHSA-r7wm-3cxj-wff9 specifically affects the incomplete fix in NonBlockingUtf8JsonParserBase in versions 2.18.6 and 2.21.1. Version 2.4.0 predates the async parser implementation by approximately 10 years and lacks all related components (NonBlockingUtf8JsonParserBase class, cr..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1", "identifiers": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.4.0-tuxcare.1" } } ], "timestamp": "2026-10-19T18:33:00.225308+00:00", "status_notes": "Vulnerability sonatype-2022-6438 affects version 2.4.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.", "vulnerability": { "name": "sonatype-2022-6438" }, "action_statement": "Vulnerability sonatype-2022-6438 affects version 2.4.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core." } ] }