{
  "@id": "urn:uuid:8ef27c79-e62f-40be-9d20-bab1304f4b11",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-22T06:17:00.168492+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:45:00.182831+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.8.11-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.8.11 is NOT affected by CVE-2025-49128. The vulnerability exists in the JsonLocation._appendSourceDesc method that extracts content snippets from byte arrays - this method was introduced in version 2.9.0 (February 2017) and does not exist in version 2.8.11 (December 2016). In 2.8.11, JsonLocation.toString() simply calls _sourceRef.toString() which returns \"[B@hexhash\" for byte arrays,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.11 is NOT affected by CVE-2025-49128. The vulnerability exists in the JsonLocation._appendSourceDesc method that extracts content snippets from byte arrays - this method was introduced in version 2.9.0 (February 2017) and does not exist in version 2.8.11 (December 2016). In 2.8.11, JsonLocation.toString() simply calls _sourceRef.toString() which returns \"[B@hexhash\" for byte arrays,..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:45:00.182831+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.8.11-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-22T06:17:00.168492+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.8.11-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. jackson-core 2.8.11 is not affected by CVE-2026-68494. The vulnerability targets the NonBlockingUtf8JsonParserBase class in the async/non-blocking parser API, which was introduced in version 2.9.0. Version 2.8.11 predates this feature entirely and contains only synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser), which the CVE explicitly excludes from its scope. The vulnerable code path (returning NOT_AVAILABLE without validating integer length during chunked streaming) does not exist in 2.8.11.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "jackson-core 2.8.11 is not affected by CVE-2026-68494. The vulnerability targets the NonBlockingUtf8JsonParserBase class in the async/non-blocking parser API, which was introduced in version 2.9.0. Version 2.8.11 predates this feature entirely and contains only synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser), which the CVE explicitly excludes from its scope. The vulnerable code path (returning NOT_AVAILABLE without validating integer length during chunked streaming) does not exist in 2.8.11."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:45:00.182831+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.8.11-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.8.11.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.8.11."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:45:00.182831+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.8.11-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:45:00.182831+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq does not affect version 2.8.11-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.8.11 is not affected by GHSA-72hv-8253-57qq. The vulnerability concerns the non-blocking (async) JSON parser bypassing maxNumberLength constraints that synchronous parsers enforce. In 2.8.11, neither the async parser API (NonBlockingUtf8JsonParserBase, createNonBlockingByteArrayParser) nor the StreamReadConstraints framework exist. The vulnerable code path cannot exist in this version...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.11 is not affected by GHSA-72hv-8253-57qq. The vulnerability concerns the non-blocking (async) JSON parser bypassing maxNumberLength constraints that synchronous parsers enforce. In 2.8.11, neither the async parser API (NonBlockingUtf8JsonParserBase, createNonBlockingByteArrayParser) nor the StreamReadConstraints framework exist. The vulnerable code path cannot exist in this version..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:45:00.182831+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 does not affect version 2.8.11-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Target version jackson-core 2.8.11 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability exists in non-blocking async JSON parsers (NonBlockingUtf8JsonParserBase) which were introduced in jackson-core 2.9. Version 2.8.11 predates this feature and contains only synchronous blocking parsers (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser) which the CVE explicitly exclude...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "impact_statement": "not_affected \u2014 Target version jackson-core 2.8.11 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability exists in non-blocking async JSON parsers (NonBlockingUtf8JsonParserBase) which were introduced in jackson-core 2.9. Version 2.8.11 predates this feature and contains only synchronous blocking parsers (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser) which the CVE explicitly exclude..."
    }
  ]
}