CVE-2026-89407
Received Received - Intake

ReDoS in FasterXML Jackson-core via NumberInput.looksLikeValidNumber

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: HeroDevs

Description
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run.  Matching cost therefore grows with the square of the input length.  An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float).  Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex.  Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool.  The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.  The fix replaces both regular expressions with a hand-rolled single-pass scan.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-89407
EUVD
EUVD-2026-84498

Affected Vendors & Products

Showing 14 associated CPEs
Vendor Product Version / Range
fasterxml jackson-core From 2.17.0 (inc)
fasterxml jackson-core From 2.17.2 (inc)
fasterxml jackson-core to 2.17.0 (exc)
fasterxml jackson-core 2.17.0
fasterxml jackson-core 2.17.2
fasterxml jackson-core 2.18.11
fasterxml jackson-core 2.21.7
fasterxml jackson-core 2.22.3
fasterxml jackson-core 3.1.7
fasterxml jackson-core 3.2.2
fasterxml jackson-core From 2.17.0 (inc) to 2.18.10 (exc)
fasterxml jackson-core From 2.19.0 (inc) to 2.21.6 (exc)
fasterxml jackson-core From 2.22.0 (inc) to 2.22.3 (exc)
fasterxml jackson-core From 3.0.0 (inc) to 3.2.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a ReDoS (Regular Expression Denial of Service) vulnerability in the Jackson-core library affecting versions 2.17.0 to 2.18.10, 2.19.0 to 2.21.6, 2.22.0 to 2.22.2, and 3.0.0 to 3.2.1. It involves quadratic backtracking in the NumberInput.PATTERN_FLOAT regex used by the looksLikeValidNumber() function. Attackers can send large crafted strings causing excessive CPU usage, with runtime growing quadratically relative to input size.

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU usage or slow processing when handling JSON inputs. Check Jackson-core versions between 2.17.0 and 2.18.10, 2.19.0 to 2.21.6, 2.22.0 to 2.22.2, and 3.0.0 to 3.2.1. Test with large inputs (e.g., 160,000+ characters) to observe O(n²) performance degradation.

Impact Analysis

An attacker can exploit this by sending a specially crafted long string to a server using Jackson-databind for JSON deserialization. This causes the vulnerable function to consume excessive CPU time, potentially exhausting server thread pools with just a few concurrent requests. For example, a 160,000-character string took 74 seconds to process, and a 1MB string could take hours.

Mitigation Strategies

Upgrade Jackson-core to patched versions (2.18.11, 2.21.7, 2.22.3, 3.1.7, or 3.2.2). Alternatively, enforce stricter input length limits (e.g., maxNumberLength) or replace regex-based parsing with a hand-written parser.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89407. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart