CVE-2026-89407: 
Java vulnerability analysis and mitigation

CVE-2026-89407 is a Regular Expression Denial of Service (ReDoS) vulnerability in FasterXML jackson-core, caused by quadratic backtracking in the NumberInput.PATTERN_FLOAT regex used by looksLikeValidNumber(). The vulnerability was introduced in version 2.17.0 and affects com.fasterxml.jackson.core:jackson-core versions 2.17.0–2.18.10, 2.19.0–2.21.6, and 2.22.0–2.22.2, as well as tools.jackson.core:jackson-core versions 3.0.0–3.1.6 and 3.2.0–3.2.1. It was disclosed on September 22, 2026, with the fix backported across all affected branches by September 11, 2026. The CVSS v3.1 base score is 7.5 (High) (GitHub Advisory).

The root cause is inefficient regular expression complexity (CWE-1333) leading to uncontrolled resource consumption (CWE-400). The PATTERN_FLOAT regex ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?) places adjacent quantifiers [0-9]* (optional) and [0-9]+ (required) over the same character class; Java's backtracking regex engine must explore every possible split point between these groups on a non-matching input, producing O(n²) time complexity. The method looksLikeValidNumber() is reached through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double, and Float). Critically, the applicable length gate is StreamReadConstraints.maxStringLength (default 20,000,000 characters) rather than maxNumberLength (default 1,000), leaving inputs four orders of magnitude larger than the library's own numeric-length policy to reach the vulnerable regex unmodified. A public PoC (PoC8_NumberInputReDoS.java) confirmed O(n²) growth with a 160,000-character input consuming 74.4 seconds in a single call (GitHub Advisory, GitHub Issue).

Successful exploitation results in a denial of service: request-handling threads are blocked for the duration of the quadratic regex evaluation, and a small number of concurrent moderately-sized requests (tens to low hundreds of KB each) can exhaust a typical web server's worker thread pool, rendering the application unresponsive to all legitimate users. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Downstream products incorporating jackson-core, including IBM DevOps Build and IBM Instana Observability, are also affected (GitHub Advisory, IBM Advisory).

A public Java proof-of-concept (PoC8_NumberInputReDoS.java) is available in the GitHub Security Advisory, demonstrating the O(n²) backtracking behavior with empirical timing data. No in-the-wild exploitation has been reported as of the time of disclosure. The attack requires no authentication, no user interaction, and is fully automatable over the network, as confirmed by NVD SSVC assessment (automatable: yes, exploitation: poc). The EPSS score is approximately 0.0063 (0.63%), indicating low but non-negligible probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA KEV catalog.

1. Identify a target endpoint: Locate a network-accessible application that uses jackson-databind to deserialize JSON into a numeric type (BigDecimal, BigInteger, Double, or Float) and runs jackson-core 2.17.0 or later (up to the patched versions).
2. Craft the malicious payload: Construct a JSON body with a string field mapped to a numeric target type, containing a long sequence of digits followed by a non-digit character (e.g., {"amount": "111...111x"} with ~160,000 digit characters). This string appears numeric but fails to match PATTERN_FLOAT, forcing exhaustive backtracking.
3. Submit the HTTP request: Send an HTTP POST or PUT request with Content-Type: application/json containing the crafted payload. The payload size (~160 KB) is well within typical request body limits but sufficient to trigger ~74 seconds of CPU time per request.
4. Trigger quadratic backtracking: jackson-databind's StdDeserializer invokes NumberInput.looksLikeValidNumber(), which applies PATTERN_FLOAT to the attacker-controlled string. The Java regex engine explores O(n²) state combinations before concluding non-match, blocking the request-handling thread for the duration.
5. Exhaust the thread pool: Submit a small number (tens to low hundreds) of concurrent requests with the crafted payload. Each request pins a worker thread for tens of seconds, rapidly exhausting the server's thread pool and denying service to all legitimate users (GitHub Advisory).

• Network: Repeated HTTP POST/PUT requests to JSON-consuming endpoints with unusually large string fields in numeric positions; requests with bodies containing long digit sequences (tens to hundreds of KB) followed by a non-digit character.
• Logs: Application access logs showing requests to deserialization endpoints that take abnormally long to complete (tens of seconds per request); thread pool exhaustion errors or timeout warnings in application server logs (e.g., java.util.concurrent.RejectedExecutionException).
• Process: Sustained high CPU usage on the Java process correlated with incoming requests; JVM thread dumps showing multiple threads blocked inside java.util.regex.Matcher.match() or NumberInput.looksLikeValidNumber().
• Application Behavior: Sudden degradation in response times or complete unavailability of the service coinciding with a burst of requests to JSON endpoints (GitHub Advisory).

Upgrade to the following patched versions of jackson-core: 2.18.11 (for 2.17.x–2.18.x), 2.21.7 (for 2.19.x–2.21.x), 2.22.3 (for 2.22.x), 3.1.7 (for 3.0.x–3.1.x), or 3.2.2 (for 3.2.x). The fix replaces the vulnerable regex patterns with a hand-written single-pass character scan, eliminating backtracking entirely. As an interim workaround, configure StreamReadConstraints.maxStringLength to a value appropriate for your application's legitimate use cases (well below the 20,000,000 default) to limit input size before it reaches the vulnerable code path. Additionally, applying wall-clock timeouts on parse/coercion operations can reduce the impact of exploitation attempts (GitHub Advisory, GitHub PR #1701).

The fix was developed and merged by jackson-core maintainer cowtowncoder (Tatu Saloranta) across all affected branches between August 9 and September 11, 2026, with the backport to 2.18 explicitly noting replacement of the two regexps with a hand-rolled single-pass scan (GitHub PR #1650, GitHub PR #1701). Multiple downstream projects in the FINOS ecosystem (rune-dsl, rune-common, rosetta-code-generators) promptly issued dependency bumps to jackson 2.18.11 following disclosure. IBM issued advisories for affected products including DevOps Build and Instana Observability (IBM Advisory). SUSE issued a security update (SUSE-SU-2026:4394-1) for affected packages in its distributions. HeroDevs highlighted the vulnerability in a blog post covering Spring Boot managed dependencies affected after EOL.