ECHO-2c66-582f-1a6e

See a problem?
Import Source
https://advisory.echohq.com/osv/ECHO-2c66-582f-1a6e.json
JSON Data
https://api.osv.dev/v1/vulns/ECHO-2c66-582f-1a6e
Upstream
Withdrawn
2026-11-12T08:00:07Z
Published
2026-10-01T15:19:21Z
Modified
2026-11-12T08:20:26Z
Summary
GHSA-p6pp-m3f8-5c89: ReDoS in the PATTERN_FLOAT regex used by NumberInput.looksLikeValidNumber(). That method and the regex were added in 2.17.0 (c381325d, #1160). At tag jackson-core-2.14.0-rc2 NumberInput has no looksLikeValidNumber, no PATTERN_FLOAT and no java.util.regex use. GitHub's range starts at 2.17.0.
Details
References

Affected packages

Echo
elasticsearch-9.4

Package

Name
elasticsearch-9.4
Purl
pkg:deb/echo/elasticsearch-9.4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.4.8+e1

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-2c66-582f-1a6e.json"
elasticsearch-9.5

Package

Name
elasticsearch-9.5
Purl
pkg:deb/echo/elasticsearch-9.5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.5.5+e1

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-2c66-582f-1a6e.json"
Echo:Maven
com.fasterxml.jackson.core:jackson-core

Package

Name
com.fasterxml.jackson.core:jackson-core
Purl
pkg:maven/com.fasterxml.jackson.core/jackson-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.14.0-rc2
Fixed
2.14.0-rc2+echo.1

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-2c66-582f-1a6e.json"
tools.jackson.core:jackson-core

Package

Name
tools.jackson.core:jackson-core
Purl
pkg:maven/tools.jackson.core/jackson-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-2c66-582f-1a6e.json"