GHSA-hgj6-7826-r7m5 CVE-2026-54514
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.37%
- Chance of exploitation in the next 30 days. Higher than 30.67% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
- Available
- 2 packages have a fixed version
Description
Summary
JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect.
Impact
An attacker controlling JSON deserialized into an InetSocketAddress-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.
Affected / Patched (verified via git tag --contains on 1f5a103)
- 2.18 line:
>= 2.18.0, < 2.18.8-> fixed in 2.18.8 - 2.19-2.21 line:
>= 2.19.0, < 2.21.4-> fixed in 2.21.4 - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4
Severity / CWE
Maintainer: minor. Reporter: LOW. CWE-918 (SSRF).
Upstream fix
FasterXML/jackson-databind#5951 ("Improve InetSocketAddress deserialization"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | >= 2.0.0, < 2.18.8 |
2.18.8 |
| com.fasterxml.jackson.core:jackson-databind | >= 2.19.0, < 2.21.4 |
2.21.4 |
| com.fasterxml.jackson.core:jackson-databind | >= 3.0.0, < 3.1.4 |
3.1.4 |
| tools.jackson.core:jackson-databind | >= 2.19.0, < 2.21.4 |
2.21.4 |
| tools.jackson.core:jackson-databind | >= 3.0.0, < 3.1.4 |
3.1.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
com.fasterxml.jackson.core:jackson-databind Maven → 2.18.8
- maven
<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.18.8</version></dependency>- gradle
implementation("com.fasterxml.jackson.core:jackson-databind:2.18.8")
tools.jackson.core:jackson-databind Maven → 2.21.4
- maven
<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.21.4</version></dependency>- gradle
implementation("tools.jackson.core:jackson-databind:2.21.4")
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-cxp5-3px4-pw24 jackson-databind quadratic forward-reference completion | High | Also affects com.fasterxml.jackson.core:jackson-databind |
| GHSA-wv8q-qhhj-9h54 jackson-databind retains every unknown raw type ID | High | Also affects com.fasterxml.jackson.core:jackson-databind |
| GHSA-q4xh-88c3-wmh7 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS | High | Also affects com.fasterxml.jackson.core:jackson-databind |
| GHSA-gx83-3vf8-gh7j jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) | Medium | Also affects com.fasterxml.jackson.core:jackson-databind |
| GHSA-wjgm-6hv5-3cvf jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution | Medium | Also affects com.fasterxml.jackson.core:jackson-databind |
| GHSA-vvgp-rfg2-7rr6 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization | Medium | Also affects com.fasterxml.jackson.core:jackson-databind |
| GHSA-mhm7-754m-9p8w jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)` | Medium | Also affects com.fasterxml.jackson.core:jackson-databind |
| GHSA-5gvw-p9qm-jgwh jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization | Medium | Also affects com.fasterxml.jackson.core:jackson-databind |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor