CVE-2026-89407

A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service (ReDoS) vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber() method's PATTERN_FLOAT regular expression. A small number of concurrent requests with a long input string can exhaust a server's request-handling thread pool, leading to a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because while remote actors can induce CPU starvation to trigger a denial of service, the issue affects availability only without granting unauthorized access or data tampering capabilities. In Red Hat environments, exposure depends on services deserializing untrusted JSON payloads into numeric Java object types where default string coercion occurs. Older releases packaging jackson-core versions prior to 2.17.0 do not include the vulnerable pattern matching logic and are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.