Jackson Databind’s InetAddress deserialization routine resolves DNS names eagerly for strings supplied by an attacker. This behavior allows an attacker to inject a custom hostname that will be queried by the Java runtime, enabling SSRF attacks that reach internal network services and gather host names that should remain hidden. The weakness is a classic injection flaw described by CWE‑918 and is scored with a CVSS base of 5.3, indicating medium overall risk.

The vulnerability affects the FasterXML Jackson Databind library, versions prior to 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines. These versions are commonly used in Java applications that deserialize JSON data.

With a CVSS score of 5.3 and no EPSS data, the current exploitation likelihood is uncertain, but the issue is not yet in the CISA KEV catalog. The attack vector is inferred as remote or local deserialization of attacker‑controlled input; any code that deserializes arbitrary JSON could be exploited once the deserialization library is loaded. No privileged escalation is required beyond access to an endpoint that accepts deserialized data.