The vulnerability arises from two regular expressions (PATTERN_FLOAT and PATTERN_FLOAT_TRAILING_DOT) used in jackson-core's NumberInput.looksLikeValidNumber() method to pre-validate stringified numbers. These regexes contain adjacent quantifiers over the same character class, causing Java's regex engine to backtrack extensively on inputs that fail to match, resulting in O(n^2) matching cost relative to input length. An attacker supplying large JSON numeric strings can trigger this behavior during deserialization via jackson-databind's default String-to-number coercion. The default maxStringLength constraint (20 million characters) does not prevent this. Testing showed a 160,000-character input took approximately 74 seconds to process, enabling denial-of-service by exhausting server thread pools. The issue affects jackson-core versions starting at 2.17.0 and was fixed by replacing the regexes with a hand-rolled single-pass scan.

This vulnerability can cause denial-of-service (DoS) by allowing an attacker to supply specially crafted JSON numeric strings that trigger excessive regex backtracking during deserialization. This results in high CPU consumption and thread exhaustion on affected servers. There is no impact on confidentiality or integrity. The vulnerability requires no privileges or user interaction and is exploitable remotely via network access to JSON deserialization endpoints.

A fix is available that replaces the vulnerable regular expressions with a more efficient single-pass scanning method. Users should upgrade to a jackson-core version later than the affected ranges (versions after 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.1 respectively) where this fix is applied. No other mitigations are indicated. Patch status is confirmed by the vendor's description of the fix. There is no indication that this vulnerability is mitigated by configuration or that no action is required.