CVE-2026-77310

jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

State: Published
Severity: 5.3 Medium
Published: Aug 24, 2026
Updated: Aug 25, 2026
Reserved: Aug 20, 2026

Read the record on cve.org

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
com.fasterxml.jackson.core:jackson-databindFasterXML	>= 2.0.0, < 2.18.9Affected >= 2.19.0, < 2.21.5Affected >= 2.22.0, < 2.22.1Affected
tools.jackson.core:jackson-databindFasterXML	>= 3.0.0, < 3.1.5Affected >= 3.2.0, < 3.2.1Affected

References

https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.