{
  "@id": "urn:uuid:e035ebf2-98ac-4b71-add2-9197103b56f4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-22T06:17:00.168492+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.6.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Target version 2.6.0 is NOT affected by CVE-2025-49128. The vulnerability requires the `_appendSourceDesc()` method that extracts byte array content snippets into exception messages. This method was introduced in jackson-core 2.9.0 and contained the offset-ignoring flaw until fixed in 2.13.0. Version 2.6.0 predates the vulnerable code - its JsonLocation.toString() simply calls `_sourceRef.toStr...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Target version 2.6.0 is NOT affected by CVE-2025-49128. The vulnerability requires the `_appendSourceDesc()` method that extracts byte array content snippets into exception messages. This method was introduced in jackson-core 2.9.0 and contained the offset-ignoring flaw until fixed in 2.13.0. Version 2.6.0 predates the vulnerable code - its JsonLocation.toString() simply calls `_sourceRef.toStr..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.6.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T06:17:00.168492+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.6.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. jackson-core 2.6.0 is not affected by CVE-2026-68494. This CVE describes an incomplete fix in the async/non-blocking parser (NonBlockingUtf8JsonParserBase) where streaming integer parsing can bypass maxNumberLength constraints when input is fed in chunks without terminators. Version 2.6.0 (released July 2015) predates the introduction of the async parser infrastructure (added in 2.9.0, late 2017) and does not contain the vulnerable code. The target has only synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) which use a blocking I/O model without the suspension/resumption mechanism that creates the vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "jackson-core 2.6.0 is not affected by CVE-2026-68494. This CVE describes an incomplete fix in the async/non-blocking parser (NonBlockingUtf8JsonParserBase) where streaming integer parsing can bypass maxNumberLength constraints when input is fed in chunks without terminators. Version 2.6.0 (released July 2015) predates the introduction of the async parser infrastructure (added in 2.9.0, late 2017) and does not contain the vulnerable code. The target has only synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) which use a blocking I/O model without the suspension/resumption mechanism that creates the vulnerability."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.6.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.6.0.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.6.0."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.6.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    }
  ]
}