Deserialization of JSON that contains an InetSocketAddress field triggers an eager DNS lookup when the default JDKFromStringDeserializer constructs the address with new InetSocketAddress(host,port). This occurs before any application‑level validation or network connect logic, allowing an attacker to force the application to resolve arbitrary hostnames at deserialization time. The primary consequence is the ability to perform internal network reconnaissance or create outbound connections, which is a classic SSRF risk, without granting full code execution or privilege escalation.

The vulnerability affects the FasterXML jackson‑databind library in versions from 2.0.0 up to but not including 2.18.8, 2.21.4, and 3.1.4. These releases contain the bug where InetSocketAddress is created with eager DNS resolution during deserialization. Versions starting at 2.18.8, 2.21.4, and 3.1.4 and later have been fixed to defer DNS resolution until an explicit connect call.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits at this time. An attacker can exploit this flaw by providing crafted JSON to any component that deserializes untrusted input into the affected library, resulting in unsolicited DNS queries or connections. Exploitation requires that the application accepts untrusted JSON and uses the default deserialization mechanism for InetSocketAddress objects.