jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Status FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input size across five consecutive doublings 5,000 → 160,000 characters, confirming On² behavior. A single 160,000-character string smaller than a typical HTTP request...

GHSA-P6PP-M3F8-5C89 jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Status FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input size across five consecutive doublings 5,000 → 160,000 characters, confirming On² behavior. A single 160,000-character string smaller than a typical HTTP request...

CVE-2026-89407

NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOAT +-?0-9.?0-9+eE+-?0-9+?, present since 2.17.0, and PATTERNFLOATTRAILINGDOT, added in 2.17.2. PATTERNFLOAT places adjacent quantifiers over the same character...

CVE-2026-89407

FasterXML jackson-core (versions 2.17.0+) is vulnerable to a ReDoS (Regular Expression Denial of Service) in NumberInput.looksLikeValidNumber(). The PATTERN_FLOAT regex uses adjacent quantifiers over the same character class, causing quadratic backtracking when an input ultimately fails to match....

CVE-2026-89407 jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS

NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOAT +-?0-9.?0-9+eE+-?0-9+?, present since 2.17.0, and PATTERNFLOATTRAILINGDOT, added in 2.17.2. PATTERNFLOAT places adjacent quantifiers over the same character...