{"action":"Upgrade com.fasterxml.jackson.core:jackson-core to 2.18.11 (2.18.x), 2.21.7 (2.21.x) or 2.22.3 (2.22.x) or later.","affected":[{"fixed":"2.18.11","introduced":"2.17.0"},{"fixed":"2.21.7","introduced":"2.19.0"},{"fixed":"2.22.3","introduced":"2.22.0"}],"component":"com.fasterxml.jackson.core:jackson-core","cve_ids":["CVE-2026-89407"],"ecosystem":"Maven","epss":0.00628,"exploited":false,"fixed_versions":["2.18.11","2.21.7","2.22.3"],"ghsa_id":"GHSA-p6pp-m3f8-5c89","id":"tcs_01M5N96PRHV6CHSWZ0C8V8Y4XK","modified_at":"2026-10-01T15:30:13.452657713Z","published_at":"2026-10-01T15:19:21Z","references":["https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff","https://github.com/FasterXML/jackson-core"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-p6pp-m3f8-5c89","url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89"}],"summary":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"}