{
  "@id": "urn:uuid:b34780a2-3619-4a01-a340-f5e86cc78897",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-19T16:44:00.184088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.8.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.8.8 is NOT affected by CVE-2025-49128. The vulnerable code pattern (buffer content extraction in exception messages that reads from offset 0 instead of the declared offset) does not exist in this version. The `_appendSourceDesc` method that performs vulnerable content snippet extraction was introduced in version 2.9.0, not in 2.8.8. While 2.8.8 accepts byte arrays with offset paramete...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.8 is NOT affected by CVE-2025-49128. The vulnerable code pattern (buffer content extraction in exception messages that reads from offset 0 instead of the declared offset) does not exist in this version. The `_appendSourceDesc` method that performs vulnerable content snippet extraction was introduced in version 2.9.0, not in 2.8.8. While 2.8.8 accepts byte arrays with offset paramete..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.8.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.8.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. CVE-2026-68494 (incomplete fix of GHSA-72hv-8253-57qq) is limited to the non-blocking async parser com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java; upstream fix 050b4298 (PR #1611) changes only that file. jackson-core 2.8.8 predates the async parser (added in 2.9.0): tuxcare-current/2.8.8 has no json/async package, and a code search finds no NonBlocking*, ByteArrayFeeder, MINOR_NUMBER_INTEGER_DIGITS or maxNumberLength/validateIntegerLength (positive control UTF8StreamJsonParser found). The only parsers present are the synchronous ones (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser), which the advisory states are not affected. The StreamReadConstraints class on the branch comes from the TuxCare CVE-2025-52999 backport and has only the nesting-depth limit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "CVE-2026-68494 (incomplete fix of GHSA-72hv-8253-57qq) is limited to the non-blocking async parser com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java; upstream fix 050b4298 (PR #1611) changes only that file. jackson-core 2.8.8 predates the async parser (added in 2.9.0): tuxcare-current/2.8.8 has no json/async package, and a code search finds no NonBlocking*, ByteArrayFeeder, MINOR_NUMBER_INTEGER_DIGITS or maxNumberLength/validateIntegerLength (positive control UTF8StreamJsonParser found). The only parsers present are the synchronous ones (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser), which the advisory states are not affected. The StreamReadConstraints class on the branch comes from the TuxCare CVE-2025-52999 backport and has only the nesting-depth limit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.8.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.8.8.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "not_affected \u2014 The vulnerable code from CVE-2026-89407 (NumberInput.PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT regex and NumberInput.looksLikeValidNumber()) was introduced in jackson-core 2.17.0 and is not present in jackson-core 2.8.8."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.8.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-19T16:44:00.184088+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 does not affect version 2.8.8-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.8.8 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability is specifically about an incomplete fix in the async/non-blocking parser's chunked-feed path (NonBlockingUtf8JsonParserBase missing validateIntegerLength calls before returning NOT_AVAILABLE). The async parser infrastructure was introduced in jackson-core 2.9.x and does not exist in version 2.8.8. Exhaustive searches confir...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.8 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability is specifically about an incomplete fix in the async/non-blocking parser's chunked-feed path (NonBlockingUtf8JsonParserBase missing validateIntegerLength calls before returning NOT_AVAILABLE). The async parser infrastructure was introduced in jackson-core 2.9.x and does not exist in version 2.8.8. Exhaustive searches confir..."
    }
  ]
}