{
  "@id": "urn:uuid:52be3e7d-1ee6-4cce-aa1c-01a440650275",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T16:28:00.145160+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability CVE-2018-1000873 affects version 2.7.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2018-1000873"
      },
      "action_statement": "Vulnerability CVE-2018-1000873 affects version 2.7.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.7.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Target repository version 2.7.0 does not contain the vulnerable code pattern. The feature that includes source content snippets in exception messages (_appendSourceDesc) was not introduced until version 2.9.0, released approximately one year after version 2.7.0. Therefore, the information disclosure vulnerability cannot manifest in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Target repository version 2.7.0 does not contain the vulnerable code pattern. The feature that includes source content snippets in exception messages (_appendSourceDesc) was not introduced until version 2.9.0, released approximately one year after version 2.7.0. Therefore, the information disclosure vulnerability cannot manifest in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.7.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.7.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core 2.7.0 is not affected by CVE-2026-68494. The vulnerability exists exclusively in the non-blocking async parser (NonBlockingUtf8JsonParserBase), which was introduced in version 2.9. The target version 2.7.0 (released October 2015) predates the async parser architecture entirely and contains only synchronous blocking parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) that do not e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "not_affected \u2014 jackson-core 2.7.0 is not affected by CVE-2026-68494. The vulnerability exists exclusively in the non-blocking async parser (NonBlockingUtf8JsonParserBase), which was introduced in version 2.9. The target version 2.7.0 (released October 2015) predates the async parser architecture entirely and contains only synchronous blocking parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) that do not e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.7.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. The target repository (jackson-core version 2.7.0) is not affected by CVE-2026-89407. The vulnerable method `NumberInput.looksLikeValidNumber()` and its problematic regex patterns do not exist in this version. The method was introduced in version 2.17.0 (December 2023), approximately 7 years after version 2.7.0 (2016) was released. Exhaustive search of the codebase confirmed the method is absent, and no alternative regex-based number validation exists that could exhibit similar ReDoS vulnerability.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "The target repository (jackson-core version 2.7.0) is not affected by CVE-2026-89407. The vulnerable method `NumberInput.looksLikeValidNumber()` and its problematic regex patterns do not exist in this version. The method was introduced in version 2.17.0 (December 2023), approximately 7 years after version 2.7.0 (2016) was released. Exhaustive search of the codebase confirmed the method is absent, and no alternative regex-based number validation exists that could exhibit similar ReDoS vulnerability."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.7.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq does not affect version 2.7.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.7.0 is not affected by CVE GHSA-72hv-8253-57qq. This CVE specifically describes a bypass vulnerability where non-blocking (async) JSON parsers fail to enforce the maxNumberLength constraint that synchronous parsers enforce. Version 2.7.0 predates both the async parser architecture and the maxNumberLength security feature entirely, making the described bypass vulnerability impossible t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "impact_statement": "not_affected \u2014 Version 2.7.0 is not affected by CVE GHSA-72hv-8253-57qq. This CVE specifically describes a bypass vulnerability where non-blocking (async) JSON parsers fail to enforce the maxNumberLength constraint that synchronous parsers enforce. Version 2.7.0 predates both the async parser architecture and the maxNumberLength security feature entirely, making the described bypass vulnerability impossible t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.0-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:28:00.145160+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 does not affect version 2.7.0-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.7.0 is not affected by GHSA-r7wm-3cxj-wff9. This vulnerability specifically targets async/non-blocking parsers (NonBlockingUtf8JsonParserBase) that don't exist in version 2.7.0, and requires bypassing a maxNumberLength constraint that is also absent from 2.7.0's StreamReadConstraints implementation.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "impact_statement": "not_affected \u2014 Version 2.7.0 is not affected by GHSA-r7wm-3cxj-wff9. This vulnerability specifically targets async/non-blocking parsers (NonBlockingUtf8JsonParserBase) that don't exist in version 2.7.0, and requires bypassing a maxNumberLength constraint that is also absent from 2.7.0's StreamReadConstraints implementation."
    }
  ]
}