{
  "@id": "urn:uuid:6d9ef308-d499-43c4-99ab-65afe5c5f1a0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T01:32:18.351129+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T08:06:58.747357+00:00",
      "status_notes": "Vulnerability CVE-2025-49128 does not affect version 2.8.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 Version 2.8.7 is NOT AFFECTED by CVE-2025-49128. The vulnerability requires the `_appendSourceDesc` method with content snippet functionality, which was introduced in version 2.9.0 (commit ce193ae9, 2017-02-22) and is NOT present in version 2.8.7. This version predates the vulnerable feature. The CVE's stated version range \"starting in version 2.0.0\" is incorrect; the vulnerable code was actual...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-49128"
      },
      "impact_statement": "not_affected \u2014 Version 2.8.7 is NOT AFFECTED by CVE-2025-49128. The vulnerability requires the `_appendSourceDesc` method with content snippet functionality, which was introduced in version 2.9.0 (commit ce193ae9, 2017-02-22) and is NOT present in version 2.8.7. This version predates the vulnerable feature. The CVE's stated version range \"starting in version 2.0.0\" is incorrect; the vulnerable code was actual..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T08:06:58.747357+00:00",
      "status_notes": "Vulnerability CVE-2025-52999 is fixed in version 2.8.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2025-52999"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T01:32:18.351129+00:00",
      "status_notes": "Vulnerability CVE-2026-18401 affects version 2.8.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-18401"
      },
      "action_statement": "Vulnerability CVE-2026-18401 affects version 2.8.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T09:58:59.407356+00:00",
      "status_notes": "Vulnerability CVE-2026-68494 does not affect version 2.8.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. Version 2.8.7 is not affected by CVE-2026-68494. The vulnerability requires NonBlockingUtf8JsonParserBase (non-blocking async parser) and StreamReadConstraints.maxNumberLength, neither of which exist in 2.8.7. The CVE explicitly states: \"Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases.\" Version 2.8.7 only contains synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser), which the CVE explicitly excludes from its scope. Rule 5 Type A1 applies: the Brief's INPUT (chunked JSON numeric values fed to a non-blocking parser) is not received anywhere in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-68494"
      },
      "impact_statement": "Version 2.8.7 is not affected by CVE-2026-68494. The vulnerability requires NonBlockingUtf8JsonParserBase (non-blocking async parser) and StreamReadConstraints.maxNumberLength, neither of which exist in 2.8.7. The CVE explicitly states: \"Versions prior to 2.15.0 are not affected, because StreamReadConstraints -- which defines the maxNumberLength setting -- was first introduced in jackson-core 2.15.0, so no such constraint exists to be bypassed in earlier releases.\" Version 2.8.7 only contains synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser), which the CVE explicitly excludes from its scope. Rule 5 Type A1 applies: the Brief's INPUT (chunked JSON numeric values fed to a non-blocking parser) is not received anywhere in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T09:58:59.407356+00:00",
      "status_notes": "Vulnerability CVE-2026-89407 does not affect version 2.8.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. jackson-core version 2.8.7 is NOT affected by CVE-2026-89407. The vulnerability exists in the `NumberInput.looksLikeValidNumber()` method with its catastrophic backtracking regex patterns (PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT), which was introduced in version 2.17.0. Version 2.8.7 predates this addition by nearly a decade and uses direct parsing (Double.parseDouble, new BigDecimal) without any regex-based pre-validation. The vulnerable code simply does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-89407"
      },
      "impact_statement": "jackson-core version 2.8.7 is NOT affected by CVE-2026-89407. The vulnerability exists in the `NumberInput.looksLikeValidNumber()` method with its catastrophic backtracking regex patterns (PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT), which was introduced in version 2.17.0. Version 2.8.7 predates this addition by nearly a decade and uses direct parsing (Double.parseDouble, new BigDecimal) without any regex-based pre-validation. The vulnerable code simply does not exist in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T08:06:58.747357+00:00",
      "status_notes": "Vulnerability CVE-2026-89425 is fixed in version 2.8.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core.",
      "vulnerability": {
        "name": "CVE-2026-89425"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T08:06:58.747357+00:00",
      "status_notes": "Vulnerability GHSA-72hv-8253-57qq does not affect version 2.8.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core version 2.8.7 is not affected by GHSA-72hv-8253-57qq. The vulnerability specifically targets the non-blocking (async) JSON parser infrastructure (NonBlockingUtf8JsonParserBase and related classes), which does not exist in version 2.8.7. This version only includes synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser). The async parser API was int...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-72hv-8253-57qq"
      },
      "impact_statement": "not_affected \u2014 jackson-core version 2.8.7 is not affected by GHSA-72hv-8253-57qq. The vulnerability specifically targets the non-blocking (async) JSON parser infrastructure (NonBlockingUtf8JsonParserBase and related classes), which does not exist in version 2.8.7. This version only includes synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser). The async parser API was int..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.8.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T08:06:58.747357+00:00",
      "status_notes": "Vulnerability GHSA-r7wm-3cxj-wff9 does not affect version 2.8.7-tuxcare.1 of com.fasterxml.jackson.core:jackson-core. not_affected \u2014 jackson-core 2.8.7 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability is specific to the async/non-blocking parser (NonBlockingUtf8JsonParserBase) which was introduced in jackson-core 2.9.0 (released 2017). Version 2.8.7 predates this feature entirely and contains only synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser), which the CVE explicitly exc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r7wm-3cxj-wff9"
      },
      "impact_statement": "not_affected \u2014 jackson-core 2.8.7 is not affected by GHSA-r7wm-3cxj-wff9. The vulnerability is specific to the async/non-blocking parser (NonBlockingUtf8JsonParserBase) which was introduced in jackson-core 2.9.0 (released 2017). Version 2.8.7 predates this feature entirely and contains only synchronous parsers (UTF8StreamJsonParser, ReaderBasedJsonParser, UTF8DataInputJsonParser), which the CVE explicitly exc..."
    }
  ]
}