Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-89407 high CVSS 7.5

Vulnerability in com.fasterxml.jackson.core:jackson-core (CVE-2026-89407)

Summary

Vulnerability in com.fasterxml.jackson.core:jackson-core (CVE-2026-89407). Risk of unauthorized operations or information disclosure. Exploitable via PATTERN_FLOAT. Mitigation: upgrade to 2.22.3 or later.

Original description

The description as published by the source.

Status

FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost
exactly 4x for every doubling of input size across five consecutive doublings (5,000 → 160,000
characters), confirming O(n²) behavior. A single 160,000-character string (smaller than a typical
HTTP request body) took 74.4 seconds for one call to NumberInput.looksLikeValidNumber().

Affected Component / Version

  • Package: com.fasterxml.jackson.core:jackson-core
  • Confirmed against: jackson-core-2.20.2
  • Affected file: src/main/java/com/fasterxml/jackson/core/io/NumberInput.java
    (PATTERN_FLOAT line ~41-42, PATTERN_FLOAT_TRAILING_DOT line ~51, entry point
    looksLikeValidNumber() lines ~646-656)

Technical Analysis

private final static Pattern PATTERN_FLOAT = Pattern.compile(
      "[+-]?[0-9]*[\\.]?[0-9]+([eE][+-]?[0-9]+)?");

private final static Pattern PATTERN_FLOAT_TRAILING_DOT = Pattern.compile(
        "[+-]?[0-9]+[\\.]");

public static boolean looksLikeValidNumber(final String s) {
    // ... short-circuits only for null/empty/length==1 ...
    return PATTERN_FLOAT.matcher(s).matches()
            || PATTERN_FLOAT_TRAILING_DOT.matcher(s).matches();
}

PATTERN_FLOAT contains ambiguous, adjacent quantifiers over the identical character class:
[0-9]* (optional digits), an optional [.], then [0-9]+ (required digits). Java's
backtracking Pattern/Matcher engine has no possessive quantifiers or atomic grouping…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-89407 has been found in com.fasterxml.jackson.core:jackson-core.
Attackers can target a specific entry point like PATTERN_FLOAT over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 7.5/10.
What to do: upgrade com.fasterxml.jackson.core:jackson-core to 2.22.3 or later.
If unsure, ask your IT team or search "com.fasterxml.jackson.core:jackson-core CVE-2026-89407" on the vendor's site.

CVE-2026-89407 (com.fasterxml.jackson.core:jackson-core) — CWE-400 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT / Pattern / Matcher
Patched: 2.22.3 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-400) exists in com.fasterxml.jackson.core:jackson-core. Attackers reach the vulnerable code path via PATTERN_FLOAT without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of com.fasterxml.jackson.core:jackson-core. Attack surface: PATTERN_FLOAT / PATTERN_FLOAT_TRAILING_DOT / Pattern / Matcher.

🔥 Severity

Severity: High (CVSS 7.5/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 2.22.3.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    Audit SBOM/dependencies for affected components.

    資産台帳・SBOM・依存マニフェストで com.fasterxml.jackson.core:jackson-core を使っているサービスとバージョンを洗い出す。

  2. 2
    Apply patch patch 
    Upgrade com.fasterxml.jackson.core:jackson-core to 2.22.3

    ステージング環境で 2.22.3 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

maven com.fasterxml.jackson.core:jackson-core
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.3"}]}]
maven tools.jackson.core:jackson-core
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details