FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

jackson-core -- denial of service

Affected packages
		jackson-core	<	2.22.3

Details

VuXML ID	6a9d0f14-cf3d-11f1-a655-3497f65b111b
Discovery	2026-09-21
Entry	2026-10-22

The Jackson project reports:

CVE-2026-89407: NumberInput.looksLikeValidNumber() pre-validates stringified numbers with PATTERN_FLOAT, whose adjacent quantifiers allow catastrophic backtracking on crafted input.

CVE-2026-89425: UTF8DataInputJsonParser builds the offending token text for an error message in a loop without an upper bound, so it ignores maxErrorTokenLength. The other three parser implementations are not affected.

[source]

References

CVE Name	CVE-2026-89407
CVE Name	CVE-2026-89425
URL	https://github.com/FasterXML/jackson-core/blob/2.x/release-notes/VERSION-2.x