{
  "@id": "urn:uuid:7d5b7a05-b82a-42c0-9d87-670fd65c3c21",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T16:44:00.184088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.7.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.7.4 does not contain the vulnerable code path. The `_appendSourceDesc` method that extracts byte array content for exception messages was introduced in version 2.9.0 (commit ce193ae9, February 2017) and fixed in version 2.13.0 (September 2021). Version 2.7.4 (April 2016) predates this feature. JsonLocation.toString() in 2.7.4 only calls Object.toString() on byte arrays, producing \"[B@...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.7.4 does not contain the vulnerable code path. The `_appendSourceDesc` method that extracts byte array content for exception messages was introduced in version 2.9.0 (commit ce193ae9, February 2017) and fixed in version 2.13.0 (September 2021). Version 2.7.4 (April 2016) predates this feature. JsonLocation.toString() in 2.7.4 only calls Object.toString() on byte arrays, producing \"[B@..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.7.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.7.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. CVE-2026-68494 is an incomplete fix of GHSA-72hv-8253-57qq (commit b0c428e6): the integer-digit paths in the non-blocking async parser (com.fasterxml.jackson.core.json.async.NonBlockingUtf8JsonParserBase) that return NOT_AVAILABLE skip validateIntegerLength. That async parser first appeared upstream in jackson-core 2.9.0. In tuxcare-current/2.7.4 (bc37b193) there is no json/async package, and a branch search finds no NonBlocking* classes, no ByteArrayFeeder and no JsonFactory.createNonBlockingByteArrayParser. NOT_AVAILABLE exists only as a JsonToken constant and no parser returns it. Only the blocking parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) are present, so the vulnerable code is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "CVE-2026-68494 is an incomplete fix of GHSA-72hv-8253-57qq (commit b0c428e6): the integer-digit paths in the non-blocking async parser (com.fasterxml.jackson.core.json.async.NonBlockingUtf8JsonParserBase) that return NOT_AVAILABLE skip validateIntegerLength. That async parser first appeared upstream in jackson-core 2.9.0. In tuxcare-current/2.7.4 (bc37b193) there is no json/async package, and a branch search finds no NonBlocking* classes, no ByteArrayFeeder and no JsonFactory.createNonBlockingByteArrayParser. NOT_AVAILABLE exists only as a JsonToken constant and no parser returns it. Only the blocking parsers (UTF8StreamJsonParser, ReaderBasedJsonParser) are present, so the vulnerable code is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.7.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.7.4.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.7.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.7.4-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    }
  ]
}