RHSA-2026:86706 | Vulnetix

RHSA-2026:86706 PUBLISHED CVSS 7.5 HIGH

Record from redhat · Published October 21, 2026

A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service (ReDoS) vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber() method's PATTERN_FLOAT regular expression. A small number of concurrent requests with a long input string can exhaust a server's request-handling thread pool, leading to a Denial of Service (DoS).

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Vendor	Product	Versions
Red Hat	jackson-core-0:2.21.6-1.el9_8.2.src as a component of Red Hat Enterprise Linux AppStream (v. 9)	0:2.21.6-1.el9_8.2
Red Hat	pki-jackson-core-0:2.21.6-1.el9_8.2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)	0:2.21.6-1.el9_8.2

Timeline

Oct 21, 2026 CVE Published
Oct 21, 2026 CVE Updated
Oct 21, 2026 Distribution Patch (2 in total, the first dated here)
Oct 21, 2026 Security Advisory (3 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln RHSA-2026:86706
vulnetix vdb fixes RHSA-2026:86706

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A86706/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →