CVE-2026-77310

jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

View on CVE.org

Published Aug 24, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Analysis

Technical impact

Jackson Databind’s InetAddress deserialization routine resolves DNS names eagerly for strings supplied by an attacker. This behavior allows an attacker to inject a custom hostname that will be queried by the Java runtime, enabling SSRF attacks that reach internal network services and gather host names that should remain hidden. The weakness is a classic injection flaw described by CWE‑918 and is scored with a CVSS base of 5.3, indicating medium overall risk.

Affected Systems

The vulnerability affects the FasterXML Jackson Databind library, versions prior to 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines. These versions are commonly used in Java applications that deserialize JSON data.

Risk and Exploitability

With a CVSS score of 5.3 and no EPSS data, the current exploitation likelihood is uncertain, but the issue is not yet in the CISA KEV catalog. The attack vector is inferred as remote or local deserialization of attacker‑controlled input; any code that deserializes arbitrary JSON could be exploited once the deserialization library is loaded. No privileged escalation is required beyond access to an endpoint that accepts deserialized data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FasterXML

com.fasterxml.jackson.core:jackson-databind

affected

Version	Status	Constraints
`>= 2.0.0, < 2.18.9`	affected	—
`>= 2.19.0, < 2.21.5`	affected	—
`>= 2.22.0, < 2.22.1`	affected	—

FasterXML

tools.jackson.core:jackson-databind

affected

Version	Status	Constraints
`>= 3.0.0, < 3.1.5`	affected	—
`>= 3.2.0, < 3.2.1`	affected	—

No data.

Vendor Product Versions

Fasterxml

Jackson-databind

Version	Status	Scheme	Platform
`[2.0.0,2.18.9)`	affected	semver	—
`[2.19.0,2.21.5)`	affected	semver	—
`[2.22.0,2.22.1)`	affected	semver	—

Fasterxml

Jackson-databind

Version	Status	Scheme	Platform
`[3.0.0,3.1.5)`	affected	semver	—
`[3.2.0,3.2.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Jackson Databind library to version 2.18.9 or newer in the 2.x line, 2.21.5 or newer in the 2.21.x line, 2.22.1 or newer in the 2.22.x line, 3.1.5 or newer in the 3.1.x line, or 3.2.1 or newer in the 3.2.x line.
Configure network policies to prevent internal DNS queries from the application environment, such as firewalls or DNS proxies that allow only queries to trusted external resolvers.
Restrict or validate incoming JSON data to ensure that only authorized fields are deserialized into InetAddress objects, e.g., by employing schema validation or custom deserializers that reject unexpected hostnames.

Generated by OpenCVE AI on August 24, 2026 at 20:46 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-vvgp-rfg2-7rr6	jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.313% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6
https://nvd.nist.gov/vuln/detail/CVE-2026-77310
https://www.cve.org/CVERecord?id=CVE-2026-77310

History

Sep 2, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-77310 https://www.cve.org/CVERecord?id=CVE-2026-77310
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 25, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 24, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Fasterxml Fasterxml jackson-databind
Vendors & Products		Fasterxml Fasterxml jackson-databind

Aug 24, 2026 7:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Title		jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
Weaknesses		CWE-918
References		https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`