CVE-2026-89407: jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()
Any application that coerces a String-typed JSON field to a number (default jackson-databind
behavior) is exposed: an attacker who can submit a large numeric-looking string (up to
maxStringLength’s default of 20,000,000 characters — far larger than needed given the
measured curve) can pin a request-handling thread for an extended period with a single request.
Because the cost scales quadratically, a handful of concurrent moderately-sized requests
(tens to low hundreds of KB each) is sufficient to exhaust a typical web server’s worker thread
pool, denying service to all users.
References
- github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d
- github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff
- github.com/FasterXML/jackson-core/issues/1649
- github.com/FasterXML/jackson-core/pull/1650
- github.com/FasterXML/jackson-core/pull/1701
- github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89
- github.com/advisories/GHSA-p6pp-m3f8-5c89
- nvd.nist.gov/vuln/detail/CVE-2026-89407
Code Behaviors & Features
Detect and mitigate CVE-2026-89407 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →