{
  "@id": "urn:uuid:36fa9b65-92da-4e5d-ac51-fd0063a066e3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T16:44:00.184088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:43:00.155124+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.7.9 is NOT affected by CVE-2025-49128. The vulnerable code pattern (_appendSourceDesc method that reads byte array content from position 0) was introduced between versions 2.8.0 and 2.9.0, after the 2.7.9 release. In 2.7.9, JsonLocation.toString() simply calls _sourceRef.toString() which produces a hash string for byte arrays (e.g., \"[B@1234abcd\"), not the actual content. The CVE's ve...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.7.9 is NOT affected by CVE-2025-49128. The vulnerable code pattern (_appendSourceDesc method that reads byte array content from position 0) was introduced between versions 2.8.0 and 2.9.0, after the 2.7.9 release. In 2.7.9, JsonLocation.toString() simply calls _sourceRef.toString() which produces a hash string for byte arrays (e.g., \"[B@1234abcd\"), not the actual content. The CVE's ve..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:43:00.155124+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core 2.7.9 is NOT AFFECTED by CVE-2026-68494. The vulnerability targets an incomplete fix in the async/non-blocking parser's streaming integer-digit path (specifically NonBlockingUtf8JsonParserBase) where maxNumberLength validation was not enforced before returning NOT_AVAILABLE. Version 2.7.9 does not contain any async/non-blocking parser infrastructure - this feature was introduced th...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "not_affected \u2014 jackson-core 2.7.9 is NOT AFFECTED by CVE-2026-68494. The vulnerability targets an incomplete fix in the async/non-blocking parser's streaming integer-digit path (specifically NonBlockingUtf8JsonParserBase) where maxNumberLength validation was not enforced before returning NOT_AVAILABLE. Version 2.7.9 does not contain any async/non-blocking parser infrastructure - this feature was introduced th..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:43:00.155124+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Version 2.7.9 does not contain the looksLikeValidNumber() method that exhibits the ReDoS vulnerability described in CVE-2026-89407. The vulnerable method was introduced in version 2.17.0 (released March 2024), approximately 7 years after this version was released (February 2017). The target codebase contains no regex-based number validation whatsoever; its number parsing methods use either hand-rolled character-by-character scanning (parseInt, parseLong) or the JDK's Double.parseDouble and BigDecimal constructors (parseDouble, parseBigDecimal), with no regular expressions involved.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "Version 2.7.9 does not contain the looksLikeValidNumber() method that exhibits the ReDoS vulnerability described in CVE-2026-89407. The vulnerable method was introduced in version 2.17.0 (released March 2024), approximately 7 years after this version was released (February 2017). The target codebase contains no regex-based number validation whatsoever; its number parsing methods use either hand-rolled character-by-character scanning (parseInt, parseLong) or the JDK's Double.parseDouble and BigDecimal constructors (parseDouble, parseBigDecimal), with no regular expressions involved."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:43:00.155124+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Jackson-core version 2.7.9 is not affected by GHSA-72hv-8253-57qq. The vulnerability is specific to the async/non-blocking JSON parser (NonBlockingUtf8JsonParserBase) bypassing StreamReadConstraints.maxNumberLength validation. Version 2.7.9 predates the introduction of both the async parser infrastructure (introduced ~v2.8/2.9) and the StreamReadConstraints validation framework. The target vers...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "impact_statement": "not_affected \u2014 Jackson-core version 2.7.9 is not affected by GHSA-72hv-8253-57qq. The vulnerability is specific to the async/non-blocking JSON parser (NonBlockingUtf8JsonParserBase) bypassing StreamReadConstraints.maxNumberLength validation. Version 2.7.9 predates the introduction of both the async parser infrastructure (introduced ~v2.8/2.9) and the StreamReadConstraints validation framework. The target vers..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:43:00.155124+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 does not affect version 2.7.9-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core 2.7.9 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability concerns incomplete validation in non-blocking async parsers (NonBlockingUtf8JsonParserBase) when they return NOT_AVAILABLE after running out of input mid-number parsing. Version 2.7.9 predates the entire non-blocking parser feature (introduced in 2.8.0). The target has no NonBlockingUtf8JsonParserBase class, no create...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "impact_statement": "not_affected \u2014 jackson-core 2.7.9 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability concerns incomplete validation in non-blocking async parsers (NonBlockingUtf8JsonParserBase) when they return NOT_AVAILABLE after running out of input mid-number parsing. Version 2.7.9 predates the entire non-blocking parser feature (introduced in 2.8.0). The target has no NonBlockingUtf8JsonParserBase class, no create..."
    }
  ]
}