CLEANSTART-2026-XB73842 NumberInput

CVE-2026-89407 affects multiple packages. NumberInput. See references for individual vulnerability details...

CLEANSTART-2026-ZC88513 NumberInput

CVE-2026-89407 affects multiple packages. NumberInput. See references for individual vulnerability details...

CLEANSTART-2026-PW40505 NumberInput

CVE-2026-89407 affects multiple packages. NumberInput. See references for individual vulnerability details...

CLEANSTART-2026-OZ91827 NumberInput

Security vulnerability affects the spark package. NumberInput...

CLEANSTART-2026-JK65929 NumberInput

Security vulnerability affects the trino package. NumberInput...

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Status FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input size across five consecutive doublings 5,000 → 160,000 characters, confirming On² behavior. A single 160,000-character string smaller than a typical HTTP request...

EUVD-2026-84498

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERNFLOAT via looksLikeValidNumber...

CLEANSTART-2026-MS81723 NumberInput

Security vulnerability affects the apache-nifi package. NumberInput...

PT-2026-105240

Security vulnerability affects the apache-nifi package. NumberInput...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the PATTERNFLOAT regex of NumberInput, reached through looksLikeValidNumber, where adjacent quantifiers over the same character class 0-9, then an optional ., then 0-9+ carry no possessive...

Regular Expression Denial of Service (ReDoS)

Overview com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the PATTERNFLOAT regex of NumberInput, reached through looksLikeValidNumber,...

CVE-2026-89407

NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOAT +-?0-9.?0-9+eE+-?0-9+?, present since 2.17.0, and PATTERNFLOATTRAILINGDOT, added in 2.17.2. PATTERNFLOAT places adjacent quantifiers over the same character...