{
  "@id": "urn:uuid:e472f429-7cbb-423a-b108-a6ba19ce28f2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T16:44:00.184088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.7.8 is NOT AFFECTED by CVE-2025-49128. The vulnerable code path (JsonLocation._appendSourceDesc method with byte array content snippet extraction) does not exist in this version. The method was introduced in version 2.9.0 (May 2017), after 2.7.8 (Sep 2016). The CVE's stated affected range \"2.0.0 to 2.13.0\" is inaccurate; the actual vulnerable range is 2.9.0 to 2.12.x.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.7.8 is NOT AFFECTED by CVE-2025-49128. The vulnerable code path (JsonLocation._appendSourceDesc method with byte array content snippet extraction) does not exist in this version. The method was introduced in version 2.9.0 (May 2017), after 2.7.8 (Sep 2016). The CVE's stated affected range \"2.0.0 to 2.13.0\" is inaccurate; the actual vulnerable range is 2.9.0 to 2.12.x."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. CVE-2026-68494 (GHSA-r7wm-3cxj-wff9, incomplete fix of GHSA-72hv-8253-57qq) is limited to the non-blocking async parser com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java: its integer-digit paths return NOT_AVAILABLE without validateIntegerLength (fix 050b4298, PR #1611); the synchronous parsers are explicitly not affected. The async parser first shipped in jackson-core 2.9.0; in tuxcare-current/2.7.8 (48328d77) the json/async package does not exist, there are no NonBlockingUtf8JsonParserBase/ByteArrayFeeder/createNonBlocking* symbols (blob search, positive control UTF8StreamJsonParser found), and JsonFactory exposes only blocking createParser methods. The vulnerable code is not present in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "CVE-2026-68494 (GHSA-r7wm-3cxj-wff9, incomplete fix of GHSA-72hv-8253-57qq) is limited to the non-blocking async parser com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java: its integer-digit paths return NOT_AVAILABLE without validateIntegerLength (fix 050b4298, PR #1611); the synchronous parsers are explicitly not affected. The async parser first shipped in jackson-core 2.9.0; in tuxcare-current/2.7.8 (48328d77) the json/async package does not exist, there are no NonBlockingUtf8JsonParserBase/ByteArrayFeeder/createNonBlocking* symbols (blob search, positive control UTF8StreamJsonParser found), and JsonFactory exposes only blocking createParser methods. The vulnerable code is not present in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.7.8.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.7.8."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.7.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    }
  ]
}