jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()
## Status **FULLY REPRODUCED** with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input size across five consecutive doublings (5,000 → 160,000 characters), confirming O(n²) behavior. A single 160,000-character string (smaller than a typical HTTP request body) took **74.4 seconds** for one call to `NumberInput.looksLikeValidNumber()`. ## Affected Component / Version - **Package:** `com.fasterxml.jackson.core:jackson-core` - **Confirmed against:** `jackson-core-2.20.2` - **Affected file:** `src/main/java/com/fasterxml/jackson/core/io/NumberInput.java` (`PATTERN_FLOAT` line ~41-42, `PATTERN_FLOAT_TRAILING_DOT` line ~51, entry point `looksLikeValidNumber()` lines ~646-656) ## Technical Analysis ```java private final static Pattern PATTERN_FLOAT = Pattern.compile( "[+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?"); private final static Pattern PATTERN_FLOAT_TRAILING_DOT = Pattern.compile( "[+-]?[0-9]+[\\.]"); public static boolean looksLikeValidNumber(final String s) { // ... short-circuits only for null/empty/length==1 ... return PATTERN_FLOAT.matcher(s).matches() || PATTERN_FLOAT_TRAILING_DOT.matcher(s).matches(); } ``` `PATTERN_FLOAT` contains ambiguous, adjacent quantifiers over the identical character class: `[0-9]*` (optional digits), an optional `[.]`, then `[0-9]+` (required digits). Java's backtracking `Pattern`/`Matcher` engine has no possessive quantifiers or atomic grouping here, so on a non-matching input the engine mu
GHSA-p6pp-m3f8-5c89
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-p6pp-m3f8-5c89
com.fasterxml.jackson.core:jackson-core
Source reference: /affected/0/package/name
- Affected versions
- 2.17.0
Source reference:
/affected/0/versions2.17.1Source reference:
/affected/0/versions2.17.2Source reference:
/affected/0/versions2.17.3Source reference:
/affected/0/versions2.18.0Source reference:
/affected/0/versions2.18.0-rc1Source reference:
/affected/0/versions2.18.1Source reference:
/affected/0/versions2.18.10Source reference:
/affected/0/versions2.18.2Source reference:
/affected/0/versions2.18.3Source reference:
/affected/0/versions2.18.4Source reference:
/affected/0/versions2.18.4.1Source reference:
/affected/0/versions2.18.5Source reference:
/affected/0/versions2.18.6Source reference:
/affected/0/versions2.18.7Source reference:
/affected/0/versions2.18.8Source reference:
/affected/0/versions2.18.9Source reference:
/affected/0/versions - Fixed versions
- 2.18.11
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
com.fasterxml.jackson.core:jackson-core
Source reference: /affected/1/package/name
- Affected versions
- 2.19.0
Source reference:
/affected/1/versions2.19.1Source reference:
/affected/1/versions2.19.2Source reference:
/affected/1/versions2.19.3Source reference:
/affected/1/versions2.19.4Source reference:
/affected/1/versions2.20.0Source reference:
/affected/1/versions2.20.0-rc1Source reference:
/affected/1/versions2.20.1Source reference:
/affected/1/versions2.20.2Source reference:
/affected/1/versions2.21.0Source reference:
/affected/1/versions2.21.1Source reference:
/affected/1/versions2.21.2Source reference:
/affected/1/versions2.21.3Source reference:
/affected/1/versions2.21.4Source reference:
/affected/1/versions2.21.5Source reference:
/affected/1/versions2.21.6Source reference:
/affected/1/versions - Fixed versions
- 2.21.7
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
com.fasterxml.jackson.core:jackson-core
Source reference: /affected/2/package/name
- Affected versions
- 2.22.0
Source reference:
/affected/2/versions2.22.1Source reference:
/affected/2/versions2.22.2Source reference:
/affected/2/versions - Fixed versions
- 2.22.3
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
tools.jackson.core:jackson-core
Source reference: /affected/3/package/name
- Affected versions
- 3.0.0
Source reference:
/affected/3/versions3.0.1Source reference:
/affected/3/versions3.0.2Source reference:
/affected/3/versions3.0.3Source reference:
/affected/3/versions3.0.4Source reference:
/affected/3/versions3.1.0Source reference:
/affected/3/versions3.1.0-rc1Source reference:
/affected/3/versions3.1.1Source reference:
/affected/3/versions3.1.2Source reference:
/affected/3/versions3.1.3Source reference:
/affected/3/versions3.1.4Source reference:
/affected/3/versions3.1.5Source reference:
/affected/3/versions3.1.6Source reference:
/affected/3/versions - Fixed versions
- 3.1.7
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
tools.jackson.core:jackson-core
Source reference: /affected/4/package/name
- Affected versions
- 3.2.0
Source reference:
/affected/4/versions3.2.1Source reference:
/affected/4/versions - Fixed versions
- 3.2.2
Source reference:
/affected/4/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.17.0"
},
{
"fixed": "2.18.11"
}
]
}
],
"package": {
"name": "com.fasterxml.jackson.core:jackson-core",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core",
"ecosystem": "Maven"
},
"versions": [
"2.17.0",
"2.17.1",
"2.17.2",
"2.17.3",
"2.18.0",
"2.18.0-rc1",
"2.18.1",
"2.18.10",
"2.18.2",
"2.18.3",
"2.18.4",
"2.18.4.1",
"2.18.5",
"2.18.6",
"2.18.7",
"2.18.8",
"2.18.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json",
"last_known_affected_version_range": "<= 2.18.10"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.19.0"
},
{
"fixed": "2.21.7"
}
]
}
],
"package": {
"name": "com.fasterxml.jackson.core:jackson-core",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core",
"ecosystem": "Maven"
},
"versions": [
"2.19.0",
"2.19.1",
"2.19.2",
"2.19.3",
"2.19.4",
"2.20.0",
"2.20.0-rc1",
"2.20.1",
"2.20.2",
"2.21.0",
"2.21.1",
"2.21.2",
"2.21.3",
"2.21.4",
"2.21.5",
"2.21.6"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json",
"last_known_affected_version_range": "<= 2.21.6"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.22.0"
},
{
"fixed": "2.22.3"
}
]
}
],
"package": {
"name": "com.fasterxml.jackson.core:jackson-core",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-core",
"ecosystem": "Maven"
},
"versions": [
"2.22.0",
"2.22.1",
"2.22.2"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json",
"last_known_affected_version_range": "<= 2.22.2"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.7"
}
]
}
],
"package": {
"name": "tools.jackson.core:jackson-core",
"purl": "pkg:maven/tools.jackson.core/jackson-core",
"ecosystem": "Maven"
},
"versions": [
"3.0.0",
"3.0.1",
"3.0.2",
"3.0.3",
"3.0.4",
"3.1.0",
"3.1.0-rc1",
"3.1.1",
"3.1.2",
"3.1.3",
"3.1.4",
"3.1.5",
"3.1.6"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json",
"last_known_affected_version_range": "<= 3.1.6"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2.0"
},
{
"fixed": "3.2.2"
}
]
}
],
"package": {
"name": "tools.jackson.core:jackson-core",
"purl": "pkg:maven/tools.jackson.core/jackson-core",
"ecosystem": "Maven"
},
"versions": [
"3.2.0",
"3.2.1"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-p6pp-m3f8-5c89/GHSA-p6pp-m3f8-5c89.json",
"last_known_affected_version_range": "<= 3.2.1"
}
}
]- Related CVEs
- CVE-2026-89407
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #61209 · Revision 1
- Added to Heist Feed
- Publisher date