CVE-2026-77310: jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.18.9 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.21.5 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.22.1 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 3.1.5 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 3.2.1
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to supply input that is deserialized into a java.net.InetAddress value by jackson-databind. No authentication or user interaction is required according to the supplied CVSS vector.
Which deployments are affected?
Deployments using jackson-databind before 2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1 on the applicable release line are affected when they deserialize attacker-controlled values as InetAddress.
What can an attacker do through this issue?
The attacker can cause DNS resolution of an attacker-controlled hostname during deserialization. This enables DNS-based server-side request forgery and may permit enumeration of internal hosts.
How should this be remediated?
Upgrade jackson-databind to 2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1, selecting the fixed version for the release line in use.