jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
Summary
JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect.
Impact
An attacker controlling JSON deserialized into an InetSocketAddress-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.
Affected / Patched (verified via git tag --contains on 1f5a103)
- 2.18 line:
>= 2.18.0, < 2.18.8-> fixed in 2.18.8 - 2.19-2.21 line:
>= 2.19.0, < 2.21.4-> fixed in 2.21.4 - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4
Severity / CWE
Maintainer: minor. Reporter: LOW. CWE-918 (SSRF).
Upstream fix
FasterXML/jackson-databind#5951 ("Improve InetSocketAddress deserialization"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | com.fasterxml.jackson.core:jackson-databind | >= 2.0.0, < 2.18.8, >= 2.19.0, < 2.21.4, >= 3.0.0, < 3.1.4 | 2.18.8, 2.21.4, 3.1.4 |
| Java / Kotlin (Maven) | tools.jackson.core:jackson-databind | >= 2.19.0, < 2.21.4, >= 3.0.0, < 3.1.4 | 2.21.4, 3.1.4 |
References
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5
- https://nvd.nist.gov/vuln/detail/CVE-2026-54514
- https://github.com/FasterXML/jackson-databind/pull/5951
- https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4
- https://github.com/FasterXML/jackson-databind
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-918- Platform
- Java / Kotlin (Maven)
- Package
com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind- Disclosed
- 23.06.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-hgj6-7826-r7m5 - CC BY 4.0
Vulnerability history: tools.jackson.core:jackson-databind
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 06.2026 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 5
- Medium 10
Disclosures per year
- 2026: 15
-
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.