{"action":"Upgrade tools.jackson.core:jackson-core to 3.1.7 (3.1.x) or 3.2.2 (3.2.x) or later.","affected":[{"fixed":"3.1.7","introduced":"3.0.0"},{"fixed":"3.2.2","introduced":"3.2.0"}],"component":"tools.jackson.core:jackson-core","cve_ids":["CVE-2026-89407"],"ecosystem":"Maven","epss":0.00628,"exploited":false,"fixed_versions":["3.1.7","3.2.2"],"ghsa_id":"GHSA-p6pp-m3f8-5c89","id":"tcs_01M5N96PX667R6M243Q2V85VME","modified_at":"2026-10-01T15:30:13.452657713Z","published_at":"2026-10-01T15:19:21Z","references":["https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89","https://github.com/FasterXML/jackson-core/security/advisories/GHSA-p6pp-m3f8-5c89","https://nvd.nist.gov/vuln/detail/CVE-2026-89407","https://github.com/FasterXML/jackson-core/issues/1649","https://github.com/FasterXML/jackson-core/pull/1650","https://github.com/FasterXML/jackson-core/pull/1701","https://github.com/FasterXML/jackson-core/commit/731e794f62623aa0d86ced52490166be903fbb1d","https://github.com/FasterXML/jackson-core/commit/e7acd64cc99bd346704423dc2bfea1ab0a08ddff","https://github.com/FasterXML/jackson-core"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-p6pp-m3f8-5c89#Maven/tools.jackson.core:jackson-core","url":"https://osv.dev/vulnerability/GHSA-p6pp-m3f8-5c89"}],"summary":"jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()"}