Log in Start free

Vulnerability · Published Jun 23, 2026 · Assigned by GitHub_M

CVE-2026-54514jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

Medium 5.3

In plain English

A medium-severity server-side request forgery in jackson-databind from FasterXML. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 69.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jackson-databindno fix listedDEBIAN-CVE-2026-54514
Debian:13jackson-databindno fix listedDEBIAN-CVE-2026-54514
Debian:14jackson-databind2.18.11-1DEBIAN-CVE-2026-54514
Mavencom.fasterxml.jackson.core:jackson-databind2.21.4GHSA-hgj6-7826-r7m5
Mavencom.fasterxml.jackson.core:jackson-databind2.18.8GHSA-hgj6-7826-r7m5
Mavencom.fasterxml.jackson.core:jackson-databind3.1.4GHSA-hgj6-7826-r7m5
Maventools.jackson.core:jackson-databind3.1.4GHSA-hgj6-7826-r7m5
Maventools.jackson.core:jackson-databind2.21.4GHSA-hgj6-7826-r7m5
Ubuntu:22.04:LTSjackson-databindno fix listedUBUNTU-CVE-2026-54514
Ubuntu:24.04:LTSjackson-databindno fix listedUBUNTU-CVE-2026-54514
Ubuntu:25.10jackson-databindno fix listedUBUNTU-CVE-2026-54514
Ubuntu:26.04:LTSjackson-databindno fix listedUBUNTU-CVE-2026-54514
Ubuntu:26.10jackson-databindno fix listedUBUNTU-CVE-2026-54514

Affected products (as reported)

VendorProductVersions
FasterXML jackson-databind >= 2.0.0, < 2.18.8>= 2.19.0, < 2.21.4>= 3.0.0, < 3.1.4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References