jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
Priority HIGH 72CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 22 fixed, 25 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. Matching cost therefore grows with the square of the input length. An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. The fix replaces both regular expressions with a hand-rolled single-pass scan.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00628 50th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-core (Maven): 2.18.11, 2.21.7, 2.22.3tools.jackson.core:jackson-core (Maven): 3.1.7, 3.2.2Red Hat: 21 advisoriesRed Hat: 22 fixed, 25 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FasterXML | jackson-core | 2.17.0 – 2.18.10; 2.19.0 – 2.21.6; 2.22.0 – 2.22.2 | — | No fix listed | CNA |
| FasterXML | jackson-core | 3.0.0 – 3.1.6; 3.2.0 – 3.2.1 | — | No fix listed | CNA |
| — | com.fasterxml.jackson.core:jackson-core (Maven) | 2.17.0 to before 2.18.11 | 2.18.11 | Patch available | GHSA-p6pp-m3f8-5c89 |
| — | com.fasterxml.jackson.core:jackson-core (Maven) | 2.19.0 to before 2.21.7 | 2.21.7 | Patch available | GHSA-p6pp-m3f8-5c89 |
| — | com.fasterxml.jackson.core:jackson-core (Maven) | 2.22.0 to before 2.22.3 | 2.22.3 | Patch available | GHSA-p6pp-m3f8-5c89 |
| — | tools.jackson.core:jackson-core (Maven) | 3.0.0 to before 3.1.7 | 3.1.7 | Patch available | GHSA-p6pp-m3f8-5c89 |
| — | tools.jackson.core:jackson-core (Maven) | 3.2.0 to before 3.2.2 | 3.2.2 | Patch available | GHSA-p6pp-m3f8-5c89 |
- jackson-core VendorFasterXML Affected 2.17.0 – 2.18.10; 2.19.0 – 2.21.6; 2.22.0 – 2.22.2 Fixed in — No fix listed CNA
- jackson-core VendorFasterXML Affected 3.0.0 – 3.1.6; 3.2.0 – 3.2.1 Fixed in — No fix listed CNA
- com.fasterxml.jackson.core:jackson-core (Maven) Vendor— Affected 2.17.0 to before 2.18.11 Fixed in 2.18.11 Patch available GHSA-p6pp-m3f8-5c89
- com.fasterxml.jackson.core:jackson-core (Maven) Vendor— Affected 2.19.0 to before 2.21.7 Fixed in 2.21.7 Patch available GHSA-p6pp-m3f8-5c89
- com.fasterxml.jackson.core:jackson-core (Maven) Vendor— Affected 2.22.0 to before 2.22.3 Fixed in 2.22.3 Patch available GHSA-p6pp-m3f8-5c89
- tools.jackson.core:jackson-core (Maven) Vendor— Affected 3.0.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-p6pp-m3f8-5c89
- tools.jackson.core:jackson-core (Maven) Vendor— Affected 3.2.0 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-p6pp-m3f8-5c89
Remediation
- Fix · GHSA-p6pp-m3f8-5c89 com.fasterxml.jackson.core:jackson-core (Maven) Fixed in 2.18.11 Advisory →
- Fix · GHSA-p6pp-m3f8-5c89 com.fasterxml.jackson.core:jackson-core (Maven) Fixed in 2.21.7 Advisory →
- Fix · GHSA-p6pp-m3f8-5c89 com.fasterxml.jackson.core:jackson-core (Maven) Fixed in 2.22.3 Advisory →
- Fix · GHSA-p6pp-m3f8-5c89 tools.jackson.core:jackson-core (Maven) Fixed in 3.1.7 Advisory →
- Fix · GHSA-p6pp-m3f8-5c89 tools.jackson.core:jackson-core (Maven) Fixed in 3.2.2 Advisory →
Red Hat 21 advisories
- RHSA-2026:95466 Released 2026-11-05 · Red Hat rating Importantdogtag-pki security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) dogtag-pki-11.6.0-3.el10_0.2, idm-pki-acme-11.6.0-3.el10_0.2, idm-pki-base-11.6.0-3.el10_0.2 +6
- RHSA-2026:92859 Released 2026-10-29 · Red Hat rating ImportantSatellite 6.17 security update
- Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
- RHSA-2026:92861 Released 2026-10-29 · Red Hat rating CriticalSatellite 6.19 security update
- Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +6
Show 18 more Red Hat advisories
- RHSA-2026:92858 Released 2026-10-29 · Red Hat rating ImportantSatellite 6.16 EUS security update
- Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.31.1-1.el8sat, openvox-server-8.17.0-1.el8sat, yggdrasil-worker-forwarder-0.1.1-1.el8sat
- Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
- RHSA-2026:92860 Released 2026-10-29 · Red Hat rating ImportantSatellite 6.18 security update
- Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
- RHSA-2026:92408 Released 2026-10-29 · Red Hat rating Importantdogtag-pki security update
- Red Hat Enterprise Linux AppStream (v. 10) dogtag-pki-11.9.0-6.el10_2.1, idm-pki-acme-11.9.0-6.el10_2.1, idm-pki-base-11.9.0-6.el10_2.1 +6
- RHSA-2026:88159 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
- OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88158 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
- OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88157 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
- OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88156 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
- OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88155 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
- OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88154 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
- OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88153 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
- OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88151 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
- OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88152 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
- OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88149 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
- OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88150 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
- OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:86706 Released 2026-10-21 · Red Hat rating Moderatejackson-core security update
- Red Hat Enterprise Linux AppStream (v. 9) jackson-core-2.21.6-1.el9_8.2, pki-jackson-core-2.21.6-1.el9_8.2
- RHSA-2026:83670 Released 2026-10-15 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA)
- Red Hat Build of Apache Camel 3.33.4.redhat com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar, io.micrometer.micrometer-core-1.16.7.redhat-00002.jar +14
- RHSA-2026:83520 Released 2026-10-15 · Red Hat rating ImportantRed Hat build of Quarkus 3.33.4 release and security update
- Red Hat build of Quarkus 3.33.4.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +10
- RHSA-2026:83082 Released 2026-10-15 · Red Hat rating ImportantRed Hat build of Quarkus 3.27.6 release and security update
- Red Hat build of Quarkus 3.27.6.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +11
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix planned: Will not fix |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certificate System 10 | Affected | No fix yet |
| Red Hat Certificate System 11 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet |
| Red Hat JBoss Web Server 7 | Affected | No fix yet |
| Red Hat Lightspeed for Runtimes Operator | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix yet |
| OpenShift Developer Tools and Services 4.12 | Fixed | RHSA-2026:88152 |
| OpenShift Developer Tools and Services 4.13 | Fixed | RHSA-2026:88149 |
| OpenShift Developer Tools and Services 4.14 | Fixed | RHSA-2026:88151 |
| OpenShift Developer Tools and Services 4.15 | Fixed | RHSA-2026:88150 |
| OpenShift Developer Tools and Services 4.16 | Fixed | RHSA-2026:88156 |
| OpenShift Developer Tools and Services 4.17 | Fixed | RHSA-2026:88159 |
| OpenShift Developer Tools and Services 4.18 | Fixed | RHSA-2026:88153 |
| OpenShift Developer Tools and Services 4.19 | Fixed | RHSA-2026:88158 |
| OpenShift Developer Tools and Services 4.20 | Fixed | RHSA-2026:88157 |
| OpenShift Developer Tools and Services 4.21 | Fixed | RHSA-2026:88155 |
| OpenShift Developer Tools and Services 4.22 | Fixed | RHSA-2026:88154 |
| Red Hat Build of Apache Camel 3.33.4.redhat | Fixed | RHSA-2026:83670 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:92408 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:86706 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:95466 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:92858 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:92858 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:92859 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:92860 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:92861 |
| Red Hat build of Quarkus 3.27.6.redhat | Fixed | RHSA-2026:83082 |
| Red Hat build of Quarkus 3.33.4.redhat | Fixed | RHSA-2026:83520 |
Not affected: 29 products
- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
- OpenShift Developer Tools and Services 4.16
- OpenShift Developer Tools and Services 4.17
- OpenShift Developer Tools and Services 4.18
- OpenShift Developer Tools and Services 4.19
- OpenShift Developer Tools and Services 4.20
- OpenShift Developer Tools and Services 4.21
- OpenShift Developer Tools and Services 4.22
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Apache Camel 3.33.4.redhat
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Offline Knowledge Portal
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenStack Platform 16.2
- Red Hat Satellite 6
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat Satellite 6.17 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
- Red Hat Satellite 6.19 for RHEL 9
- Red Hat build of Quarkus 3.27.6.redhat
- Red Hat build of Quarkus 3.33.4.redhat
Timeline
- 2026-10-02 Threatist record created from CVE-2026-89407
- 2026-10-03 Alias added: GHSA-p6pp-m3f8-5c89
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-07 Affected versions changed · Red Hat
- 2026-10-08 Affected versions changed · Red Hat
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83520 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83082 · Red Hat
- 2026-10-16 Fix available: Red Hat build of Quarkus 3.27.6.redhat, Red Hat build of Quarkus 3.33.4.redhat · Red Hat
- 2026-10-21 Fix available: RHSA-2026:86706 · Red Hat
- 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
- 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat
- 2026-10-29 Affected versions changed · Red Hat
- 2026-10-30 EPSS moved to the 50th–90th percentile
- 2026-10-30 Fix available: RHSA-2026:92408 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92858 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92859 · Red Hat
- 2026-10-30 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 +1 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92860 · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.18 for RHEL 9 · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.19 for RHEL 9 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92861 · Red Hat
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95466 · Red Hat
- 2026-11-06 Fix available: Red Hat Build of Apache Camel 3.33.4.redhat, Red Hat Enterprise Linux AppStream EUS (v. 10.0) · Red Hat
- 2026-11-06 Fix available: RHSA-2026:83670 · Red Hat
References
More FasterXML vulnerabilities
- TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
- TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
- TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
- TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
- TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
Sources
- CVE-2026-89407 · CVE Program
- CVE-2026-89407 · NVD
- FIRST EPSS
- GHSA-p6pp-m3f8-5c89 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-89407 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences