CVE-2026-89407

Affected versions of the `com.fasterxml.jackson.core:jackson-core` package are vulnerable to Regular Expression Denial of Service (ReDoS) because `NumberInput.looksLikeValidNumber()` checks stringified numbers against regular expressions whose adjacent quantifiers cover the same digit class. The method's use of these regular expressions causes excessive backtracking when processing input that ultimately fails to match, leading to quadratic growth in matching time relative to input length. An attacker can exploit this by sending specially crafted JSON inputs that are coerced to numeric types, potentially tying up server request threads with a few concurrent requests due to the default `maxStringLength` not mitigating the issue.