https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 17:31:31 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89407 <p><strong>Affected:</strong> FasterXML jackson-core</p> <p>NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates &#34;stringified numbers&#34; with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java&#39;s backtracking engine to retry every possible split point of the digit run.</p> <p>Matching cost therefore grows with the square of the input length.</p> <p>An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind&#39;s default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float).</p> <p>Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex.</p> <p>Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server&#39;s request-handling thread pool.</p> <p>The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.</p> <p>The fix replaces both regular expressions with a hand-rolled single-pass scan.</p> <p><strong>Affected:</strong> FasterXML jackson-core</p> <p>NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates &#34;stringified numbers&#34; with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java&#39;s backtracking engine to retry every possible split point of the digit run.</p> <p>Matching cost therefore grows with the square of the input length.</p> <p>An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind&#39;s default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float).</p> <p>Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex.</p> <p>Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server&#39;s request-handling thread pool.</p> <p>The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.</p> <p>The fix replaces both regular expressions with a hand-rolled single-pass scan.</p> https://vulnerability.circl.lu/vuln/cve-2026-89407