COM.FASTERXML.JACKSON.CORE:JACKSON-DATABIND · CVE-2026-54514
FIX → 2.21.4 · 3.1.4 +1
Not triaged yet. The sources’ own description is below.
first public Jun 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Unknown from the sources.
Upgrade to 2.21.4 · 3.1.4 +1
JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect.
An attacker controlling JSON deserialized into an InetSocketAddress-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.
git tag --contains on 1f5a103)>= 2.18.0, < 2.18.8 -> fixed in Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
>= 2.19.0, < 2.21.4 -> fixed in 2.21.4>= 3.0.0, < 3.1.4 -> fixed in 3.1.4Maintainer: minor. Reporter: LOW. CWE-918 (SSRF).
FasterXML/jackson-databind#5951 ("Improve InetSocketAddress deserialization"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.
Omkhar Arasaratnam (@omkhar) - finder.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.