{
  "@id": "urn:uuid:756e189f-4f62-4b8a-9c26-e5ce4b0e79cc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-22T06:17:00.168492+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:42:23.106673+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.6.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.6.7 is NOT AFFECTED by CVE-2025-49128. The vulnerable code path (source snippet display feature in JsonLocation._appendSourceDesc method) does not exist in this version. This feature was introduced later in version 2.9.0 (February 2017, commit ce193ae9 fixing issue #356). In 2.6.7, JsonLocation.toString() only displays object hash/identity for byte arrays (e.g., \"[B@12345678\"), never ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.6.7 is NOT AFFECTED by CVE-2025-49128. The vulnerable code path (source snippet display feature in JsonLocation._appendSourceDesc method) does not exist in this version. This feature was introduced later in version 2.9.0 (February 2017, commit ce193ae9 fixing issue #356). In 2.6.7, JsonLocation.toString() only displays object hash/identity for byte arrays (e.g., \"[B@12345678\"), never ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:43:00.210602+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.6.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T06:17:00.168492+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.6.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Version 2.6.7 is not affected by CVE-2026-68494. This CVE concerns an incomplete fix in the async parser's streaming number-accumulation path (NonBlockingUtf8JsonParserBase missing validation before NOT_AVAILABLE returns during MINOR_NUMBER_INTEGER_DIGITS state). The target version predates the async parser feature entirely: no NonBlockingUtf8JsonParserBase class, no async package, no createNonBlockingByteArrayParser() API, and no ByteArrayFeeder interface exist in 2.6.7. The vulnerable code path is structurally absent.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "Version 2.6.7 is not affected by CVE-2026-68494. This CVE concerns an incomplete fix in the async parser's streaming number-accumulation path (NonBlockingUtf8JsonParserBase missing validation before NOT_AVAILABLE returns during MINOR_NUMBER_INTEGER_DIGITS state). The target version predates the async parser feature entirely: no NonBlockingUtf8JsonParserBase class, no async package, no createNonBlockingByteArrayParser() API, and no ByteArrayFeeder interface exist in 2.6.7. The vulnerable code path is structurally absent."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:42:23.106673+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.6.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.6.7.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.6.7."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:43:00.210602+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.6.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:42:23.106673+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq does not affect version 2.6.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Target version 2.6.7 (June 2016) is not affected by GHSA-72hv-8253-57qq. The vulnerability concerns the async/non-blocking JSON parser bypassing the maxNumberLength constraint in StreamReadConstraints. Version 2.6.7 predates both the async parser (introduced in 2.9.x circa 2017-2018) and the StreamReadConstraints feature (introduced in 2.15.x circa 2022-2023). The vulnerable component (NonBlock...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "impact_statement": "not_affected \u2014 Target version 2.6.7 (June 2016) is not affected by GHSA-72hv-8253-57qq. The vulnerability concerns the async/non-blocking JSON parser bypassing the maxNumberLength constraint in StreamReadConstraints. Version 2.6.7 predates both the async parser (introduced in 2.9.x circa 2017-2018) and the StreamReadConstraints feature (introduced in 2.15.x circa 2022-2023). The vulnerable component (NonBlock..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.6.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T08:42:23.106673+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 does not affect version 2.6.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.6.7 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability concerns an incomplete fix to the async/non-blocking parser's number-length validation on the streaming chunk-feed path (returning NOT_AVAILABLE without validating accumulated digits). Jackson 2.6.7 predates both the async parser infrastructure (introduced in 2.9, per @since tag in NonBlockingUtf8JsonParserBase) and the Str...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "impact_statement": "not_affected \u2014 Version 2.6.7 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability concerns an incomplete fix to the async/non-blocking parser's number-length validation on the streaming chunk-feed path (returning NOT_AVAILABLE without validating accumulated digits). Jackson 2.6.7 predates both the async parser infrastructure (introduced in 2.9, per @since tag in NonBlockingUtf8JsonParserBase) and the Str..."
    }
  ]
}