NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates “stringified numbers” with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT, added in 2.17.2. PATTERN_FLOAT places adjacent quantifiers over the same character class — an optional [0-9]* run, an optional dot, then a required [0-9]+ run — so input that ultimately fails to match forces Java’s backtracking engine to retry every possible split point of the digit run.\u00a0<\/p>\n
Matching cost therefore grows with the square of the input length.\u00a0<\/p>\n
An attacker who can supply JSON that an application deserializes into a numeric target type reaches this method through jackson-databind’s default String-to-number coercion (StdDeserializer and NumberDeserializers for BigDecimal, BigInteger, Double and Float).\u00a0<\/p>\n
Because StreamReadConstraints.maxStringLength defaults to 20,000,000 characters, no constraint bounds the input before it reaches the regex.\u00a0<\/p>\n
Testing by the reporter confirmed O(n^2) growth across five consecutive input-size doublings, with a single 160,000-character string consuming roughly 74 seconds in one call; a small number of concurrent requests of ordinary body size can therefore exhaust a server’s request-handling thread pool.\u00a0<\/p>\n
The affected method does not exist before 2.17.0, so 2.16.x and earlier releases are not affected.\u00a0<\/p>\n
The fix replaces both regular expressions with a hand-rolled single-pass scan.<\/p>\n","protected":false},"excerpt":{"rendered":"
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates “stringified numbers” with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-27495","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/27495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=27495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=27495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=27495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}