Inefficient regular expression complexity in jackson-core - CVE-2026-89407

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU151854

Inefficient regular expression complexity in jackson-core - CVE-2026-89407

Published: September 23, 2026


Vulnerability identifier: #VU151854
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89407
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the NumberInput.PATTERN_FLOAT regular expression when processing attacker-controlled numeric-looking strings through looksLikeValidNumber(). A remote attacker can submit a crafted numeric-looking string to cause a denial of service.

Applications that coerce String-typed JSON fields to numbers can invoke the affected validation path.


Affected software

jackson-core
Test Accelerator for Z - Early Development Testing Eclipse
IBM Maximo Scheduler Optimization
CICS Transaction Gateway Desktop Edition
Security Verify Governance Adapter for CyberArk
Security Verify Governance Adapter for Google Workspace
InfoSphere Data Replication
Db2 Developer Extension
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Basesystem Module
Development Tools Module
Fedora
IBM SPSS Collaboration and Deployment Services
IBM Business Automation Workflow
IBM Netezza Performance Server
jackson-parent
jackson-annotations
jackson-dataformat-cbor
jackson-core
jackson-databind
jackson-dataformat-xml
jackson-modules-base
jackson-jaxrs-providers
jackson-bom
jackson-core (Red Hat package)
fasterxml-oss-parent

How to mitigate CVE-2026-89407

Install security update from vendor's website.

jackson-core - addressed in versions 2.18.11, 2.21.7, 2.22.3, 3.1.7, 3.2.2
Test Accelerator for Z - Early Development Testing Eclipse - update to 3.1.0
IBM SPSS Collaboration and Deployment Services - addressed in versions 8.4.0.0 IF009, 8.5.0.0 IF009, 8.6.0.0 IF009
IBM Maximo Scheduler Optimization - addressed in versions 9.0.28, 9.1.17, 9.2.4
InfoSphere Data Replication - update to 11.4.0.5-5826
jackson-parent - update to 2.18.4-1.fc44
jackson-annotations - update to 2.18.11-150200.3.28.1
jackson-dataformat-cbor - update to 2.18.11-150200.3.29.1
jackson-core - update to 2.18.11-150200.3.30.1
jackson-databind - update to 2.18.11-150200.3.36.1
jackson-dataformat-xml - update to 2.18.11-150200.5.8.1
jackson-modules-base - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-jaxrs-providers - update to 2.18.12-1.fc44
jackson-databind - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-core - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-bom - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-annotations - update to 2.18.12-1.fc44
jackson-core (Red Hat package) - update to 2.21.6-1.el9_8.2
fasterxml-oss-parent - update to 69-1.fc44
Db2 Developer Extension - update to 1.2.1
IBM Netezza Performance Server - update to 11.3.1.3 IF6

External References

Related Security Bulletins