NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that ultimately fails to match forces Java's backtracking engine to retry every possible split point of the digit run. Matching cost therefore grows with the square of the input length. An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float). Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex. Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server's request-handling thread pool. The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected. The fix replaces both regular expressions with a hand-rolled single-pass scan.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3188 advisory.

    NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates stringified numbers with two     regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and     PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same     character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that     ultimately fails to match forces Java's backtracking engine to retry every possible split point of the     digit run.

    Matching cost therefore grows with the square of the input length.

    An attacker who can supply JSON that an application deserializes into a numeric target type reaches this     method through jackson-databind's default String-to-number coercion (StdDeserializer and     NumberDeserializers for BigDecimal, BigInteger, Double and Float).

    Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the     input before it reaches the regex.

    Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a     single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent     requests of ordinary body size can therefore exhaust a server's request-handling thread pool.

    The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.

    The fix replaces both regular expressions with a hand-rolled single-pass scan. (CVE-2026-89407)

    UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text     for its error message by appending Java identifier characters to a StringBuilder in a loop that has no     upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never     consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a     parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No     StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at     all, and maxStringLength does not cover this path because the accumulation bypasses     ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a     20-million-character malformed token on the DataInput path, against 367 characters for identical input on     the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char     expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError     for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput);
    releases before 2.8.0 do not contain the affected class. (CVE-2026-89425)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22034-1 advisory.

    - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time     Issues       (bsc#1273856).
    - CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without     restricting the URI       scheme (bsc#1277883).
    - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
    - CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes     (bsc#1280125).
    - CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
    - CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable`     deserialization       (bsc#1278008).
    - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
    - CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which     allows for       unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed     (bsc#1282505).
    - CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the     raw, attacker-       supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).
    - CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan     of the pending-       reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization       (bsc#1282492).

    Changes for jackson-annotations:

    - Update to 2.18.11

    Changes for jackson-core:

    - Update to 2.18.11
     * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,      CVE-2026-89407)
     * #1698: UTF8DataInputJsonParser does not honor      maxErrorTokenLength when reporting an unrecognized token      (bsc#1282505, CVE-2026-89425)
     * #1642: Fix maxDocumentLength bypass in async parser      single-feedInput() case [GHSA-2c4j-63jj-9fqr]
     * #1643: Enforce maxNameLength incrementally in      ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)      of async parser (bsc#1273857, CVE-2026-68494)      non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

    Changes for jackson-databind:

    - Update to 2.18.11
     * #6185: Bracket unresolved IPv6 host name in InetSocketAddress      serialization
     * #6203: Prevent unbounded growth of type id cache in      TypeDeserializer (bsc#1282491, CVE-2026-91776)
     * #6204: Avoid quadratic forward-reference resolution in      Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
     * #6099: Resolve classes without initialization in      TypeFactory.findClass()
     * #6116: Reject non-ASCII digits in InetAddress literal validation
     * #6127: Add StreamReadConstraints number len constraint to      javax.xml.datatype.XMLGregorianCalendar and      javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
     * #6129: Limit the supported URL schemes for java.nio.file.Path      deserialization (bsc#1277883, CVE-2026-19032)
     * #6156: Add java.lang.Comparable in set of unsafe polymorphic      base types (bsc#1278008, CVE-2026-83557)
     * #6165: Apply number length limits to BigDecimal/BigInteger/      /Double/Float Map keys

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two
    regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and
    PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same
    character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that
    ultimately fails to match forces Java's backtracking engine to retry every possible split point of the
    digit run. Matching cost therefore grows with the square of the input length. An attacker who can supply
    JSON that an application deserializes into a numeric target type reaches this method through jackson-
    databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal,
    BigInteger, Double and Float). Because StreamReadConstraints.maxStringLength defaults to 20,000,000
    characters, no constraint bounds the input before it reaches the regex. Testing by the reporter confirmed
    O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string
    consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can
    therefore exhaust a server's request-handling thread pool. The affected method does not exist before
    2.17.0, so 2.16.x and earlier releases are not affected. The fix replaces both regular expressions with a
    hand-rolled single-pass scan. (CVE-2026-89407)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4394-1 advisory.

    - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time     Issues       (bsc#1273856).
    - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
    - CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).
    - CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).
    - CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
    - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
    - CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which     allows for       unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed     (bsc#1282505).

    Changes for jackson-annotations:

    - Update to 2.18.11

    Changes for jackson-bom:

    - Update to 2.18.11

    Changes for jackson-core:

    - Update to 2.18.11
     * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,      CVE-2026-89407)
     * #1698: UTF8DataInputJsonParser does not honor      maxErrorTokenLength when reporting an unrecognized token      (bsc#1282505, CVE-2026-89425)
     * #1642: Fix maxDocumentLength bypass in async parser      single-feedInput() case [GHSA-2c4j-63jj-9fqr]
     * #1643: Enforce maxNameLength incrementally in      ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)      of async parser (bsc#1273857, CVE-2026-68494)      non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

    Changes for jackson-databind:

    - Update to 2.18.11
     * #6185: Bracket unresolved IPv6 host name in InetSocketAddress      serialization
     * #6203: Prevent unbounded growth of type id cache in      TypeDeserializer (bsc#1282491, CVE-2026-91776)
     * #6204: Avoid quadratic forward-reference resolution in      Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
     * #6099: Resolve classes without initialization in      TypeFactory.findClass()
     * #6116: Reject non-ASCII digits in InetAddress literal validation
     * #6127: Add StreamReadConstraints number len constraint to      javax.xml.datatype.XMLGregorianCalendar and      javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
     * #6129: Limit the supported URL schemes for java.nio.file.Path      deserialization (bsc#1277883, CVE-2026-19032)
     * #6156: Add java.lang.Comparable in set of unsafe polymorphic      base types (bsc#1278008, CVE-2026-83557)
     * #6165: Apply number length limits to BigDecimal/BigInteger/      /Double/Float Map keys

    Changes for jackson-dataformat-xml:

    - Update to 2.18.11
     * Fix build to avoid past-JDK-8 bytecode generation
     * #891: Enforce StreamReadConstraints.maxNestingDepth in      FromXmlParser

    Changes for jackson-dataformats-binary:

    - Update to 2.18.11
     * #783: (protobuf) Support StreamReadConstraints.maxDocumentLength      in ProtobufParser
     * #785: (avro) Support StreamReadConstraints.maxDocumentLength and      maxTokenCount in Avro parser
     * #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion      parser (partial fix for #358)
     * #805: (ion) Support StreamReadConstraints.maxDocumentLength in      Ion parser (partial fix for #358)
     * #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser      (bsc#1282639, CVE-2026-68495)
     * #726: (smile) Ensure maxNameLength limit enforced for Smile      parser (bsc#1282640, CVE-2026-68496)
     * #727: (cbor) CBORParser.nextFieldName(SerializableString)      confuses 5-bit length marker 23 with 24 ('1-byte length suffix      follows')
     * #728: (cbor) CBORParser.nextFieldName(SerializableString)      consumes Object entry slot twice on fast-path miss, truncating      definite-length Objects
     * #733: (cbor) Long `String`s not added to 'stringref' reference      table, breaking following references
     * #735: (cbor) 'stringref' property-name paths pass 5-bit length      marker instead of actual length to shouldReferenceString()
     * #736: (cbor) Long Object property names added to 'stringref'      reference table twice

    Changes for jackson-modules-base:

    - Update to 2.18.11

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates stringified numbers with two     regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and     PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same     character class -- an optional [0-9]* run, an optional dot, then a required [0-9]+ run -- so input that     ultimately fails to match forces Java's backtracking engine to retry every possible split point of the     digit run. Matching cost therefore grows with the square of the input length. An attacker who can supply     JSON that an application deserializes into a numeric target type reaches this method through jackson-     databind's default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal,     BigInteger, Double and Float). Because StreamReadConstraints.maxStringLength defaults to 20,000,000     characters, no constraint bounds the input before it reaches the regex. Testing by the reporter confirmed     O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string     consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can     therefore exhaust a server's request-handling thread pool. The affected method does not exist before     2.17.0, so 2.16.x and earlier releases are not affected. The fix replaces both regular expressions with a     hand-rolled single-pass scan. (CVE-2026-89407)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365243	Amazon Linux 2023 : jackson-core (ALAS2023-2026-3188)	Nessus	Amazon Linux Local Security Checks	Local	high
364341	openSUSE 16: jackson-annotations / jackson-annotations-javadoc / jackson-core / etc (openSUSE-SU-2026:22034-1)	Nessus	SuSE Local Security Checks	Local	high
471598	Echo: com.fasterxml.jackson.core:jackson-core, tools.jackson.core:jackson-core: security update to 2.18.11	Tenable Cloud Security	Echo Local Security Checks	Local	high
471598	Echo: com.fasterxml.jackson.core:jackson-core, tools.jackson.core:jackson-core: security update to 2.18.11	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
351412	SUSE SLED15: jackson-annotations / jackson-core / jackson-databind / etc (SUSE-SU-2026:4394-1)	Nessus	SuSE Local Security Checks	Local	high
349353	Linux Distros Unpatched Vulnerability : CVE-2026-89407	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-89407

high

Tenable Plugins

high

high

high

high

high

high