{"id":"CVE-2026-54514","kind":"vulnerability","aliases":["CVE-2026-54514","GHSA-hgj6-7826-r7m5"],"related":[],"title":"jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)","description":"## Summary\n`JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an `InetSocketAddress` field issues an attacker-chosen DNS query during `readValue`, before any application-level validation or connect logic. The fix uses `InetSocketAddress.createUnresolved(host, port)`, deferring DNS to an explicit connect.\n\n## Impact\nAn attacker controlling JSON deserialized into an `InetSocketAddress`-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.\n\n## Affected / Patched (verified via `git tag --contains` on `1f5a103`)\n- 2.18 line: `>= 2.18.0, < 2.18.8` -> fixed in **2.18.8**\n- 2.19-2.21 line: `>= 2.19.0, < 2.21.4` -> fixed in **2.21.4**\n- 3.x line: `>= 3.0.0, < 3.1.4` -> fixed in **3.1.4**\n\n## Severity / CWE\nMaintainer: minor. Reporter: LOW. CWE-918 (SSRF).\n\n## Upstream fix\nFasterXML/jackson-databind#5951 (\"Improve InetSocketAddress deserialization\"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.","summary":"When jackson-databind binds untrusted JSON into a type with an InetSocketAddress field, it resolves hostnames through DNS during parsing. An attacker can force the application to send DNS queries for hostnames they choose, which can be used for server-side request forgery or probing internal resolvers.","severity":"medium","cvss":5.3,"epss":0.00368,"exploited":false,"exploited_at":null,"products":[{"name":"com.fasterxml.jackson.core:jackson-databind","fixed":["2.18.8"],"affected":">= 2.0.0, < 2.18.8","ecosystem":"maven"},{"name":"com.fasterxml.jackson.core:jackson-databind","fixed":["2.21.4"],"affected":">= 2.19.0, < 2.21.4","ecosystem":"maven"},{"name":"tools.jackson.core:jackson-databind","fixed":["3.1.4"],"affected":">= 3.0.0, < 3.1.4","ecosystem":"maven"},{"name":"fasterxml jackson-databind","fixed":["2.18.8"],"affected":">= 2.0.0, < 2.18.8","ecosystem":"vendor"},{"name":"fasterxml jackson-databind","fixed":["2.21.4"],"affected":">= 2.19.0, < 2.21.4","ecosystem":"vendor"},{"name":"fasterxml jackson-databind","fixed":["3.1.4"],"affected":">= 3.0.0, < 3.1.4","ecosystem":"vendor"},{"via":"cpe","name":"com.fasterxml.jackson.core:jackson-databind","fixed":["3.1.4"],"affected":">= 3.0.0, < 3.1.4","ecosystem":"maven"}],"ecosystems":["maven","vendor"],"tags":["cwe-918","jackson-databind","java","package","spring-boot"],"not_affected_if":["no-inetsocketaddress-fields","no-untrusted-json-binding"],"how_to_check":"- Check the jackson-databind version in your build file or dependency tree (for example `mvn dependency:tree` or `gradle dependencies`).\n- Search your code for classes that bind JSON into fields of type `InetSocketAddress`.","fix":"- com.fasterxml.jackson.core:jackson-databind 2.18.x: move to `2.18.8`\n- com.fasterxml.jackson.core:jackson-databind 2.19.x to 2.21.x: move to `2.21.4`\n- tools.jackson.core:jackson-databind 3.x: move to `3.1.4`","status":"open","published_at":"2026-06-23T21:17:02+00:00","first_seen_at":"2026-11-10T19:34:54+00:00","triaged_at":"2026-11-10T20:05:02+00:00","updated_at":"2026-11-10T20:15:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T20:05:02Z","model":"claude-haiku-5-5","output":{"fix":"- com.fasterxml.jackson.core:jackson-databind 2.18.x: move to `2.18.8`\n- com.fasterxml.jackson.core:jackson-databind 2.19.x to 2.21.x: move to `2.21.4`\n- tools.jackson.core:jackson-databind 3.x: move to `3.1.4`","reach":"network","title":"jackson-databind: InetSocketAddress deserialization makes server send attacker-chosen DNS lookups","impact":"low","summary":"When jackson-databind binds untrusted JSON into a type with an InetSocketAddress field, it resolves hostnames through DNS during parsing. An attacker can force the application to send DNS queries for hostnames they choose, which can be used for server-side request forgery or probing internal resolvers.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","jackson-databind","spring-boot"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"server makes attacker-chosen DNS lookups, enabling SSRF-style probing","analyst_note":"","how_to_check":"- Check the jackson-databind version in your build file or dependency tree (for example `mvn dependency:tree` or `gradle dependencies`).\n- Search your code for classes that bind JSON into fields of type `InetSocketAddress`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-inetsocketaddress-fields","no-untrusted-json-binding"],"who_is_affected":"Applications that use jackson-databind to deserialize untrusted JSON into a type that contains an InetSocketAddress field are exposed, because the DNS lookup happens during readValue before any application validation. Applications that never bind untrusted input into such types, or that do not use InetSocketAddress fields, are unlikely to be affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000873,"input_tokens":5278,"output_tokens":691,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-04':264C '-06':263C '-2.21':230C '-2026':12A,20A '-54514':13A,21A '-918':51B,252C '1f5a103':221C '2.18':222C '2.18.0':224C '2.18.8':225C,228C,266C '2.19':229C '2.19.0':232C '2.21.4':233C,236C,267C '2026':262C '3':237C '3.0.0':240C '3.1.4':241C,244C,268C '5951':257C '7826':17A 'affect':213C 'applic':86B,131C,155C 'application-level':154C 'arasaratnam':271C 'attack':82B,146C,175C,191C 'attacker-chosen':145C,190C 'band':204C 'base':200C 'bear':182C 'bind':64B,133C,212C 'boot':59B 'choos':94B 'chosen':147C,192C 'com.fasterxml.jackson.core':22A,26A,46A 'connect':159C,172C 'construct':111C 'contain':139C,219C 'control':176C 'credit':269C 'cve':11A,19A 'cwe':50B,246C,251C 'databind':3A,25A,29A,33A,37A,41A,45A,49A,54B,63B 'defer':167C 'deseri':5A,128C,178C,195C,260C 'dns':8A,78B,89B,121C,148C,168C,187C,199C 'dns-base':198C 'eager':7A,120C 'explicit':171C 'fasterxml':34A,38A,42A 'fasterxml/jackson-databind':256C 'field':73B,142C 'finder':273C 'fix':162C,226C,234C,242C,255C 'forc':84B,185C 'forgeri':104B 'ghsa':15A 'ghsa-hgj6':14A 'git':217C 'hgj6':16A 'host':116C,165C 'hostnam':76B,92B,125C,193C 'impact':173C 'improv':258C 'inetsocketaddress':4A,72B,112C,115C,141C,181C,259C 'inetsocketaddress.createunresolved':164C 'input':126C 'interact':205C 'intern':107B,207C 'internal-resolv':206C 'issu':143C 'jackson':2A,24A,28A,32A,36A,40A,44A,48A,53B,62B 'jackson-databind':1A,23A,27A,31A,35A,39A,43A,47A,52B,61B 'java':55B 'jdkfromstringdeseri':110C 'json':66B,135C,177C 'level':156C 'line':223C,231C,239C 'logic':160C 'lookup':188C 'low':250C 'maintain':247C 'minor':248C 'name':122C 'new':114C 'omkhar':270C,272C 'out-of-band':201C 'outbound':186C 'packag':56B 'pars':80B 'patch':214C 'perform':119C 'port':117C,166C 'probe':106B,209C 'pure':210C 'queri':90B,149C 'r7m5':18A 'readvalu':151C 'releas':261C 'report':249C 'request':103B 'resolut':9A,123C 'resolv':75B,108B,208C 'send':88B 'server':101B 'server-sid':100B 'sever':245C 'side':102B 'spring':58B 'spring-boot':57B 'ssrf':10A,197C,253C 'summari':109C 'tag':218C 'time':129C,196C 'tools.jackson.core':30A 'trigger':6A 'type':69B,138C,183C 'untrust':65B,134C 'upstream':254C 'use':98B,163C 'valid':157C 'verifi':215C 'via':216C 'x':238C","nicknames":[],"mitigations":[],"who_affected":"Applications that use jackson-databind to deserialize untrusted JSON into a type that contains an InetSocketAddress field are exposed, because the DNS lookup happens during readValue before any application validation. Applications that never bind untrusted input into such types, or that do not use InetSocketAddress fields, are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["comfasterxmljacksoncorejacksondatabind","fasterxmljacksondatabind","jacksondatabind","toolsjacksoncorejacksondatabind"],"ptokens":["com","core","databind","fasterxml","jackson","tools"],"labels":["cwe918","jacksondatabind","java","maven","medium","package","springboot","vendor"],"campaign_type":null,"search_a":"'-2026':12A,20A '-54514':13A,21A '7826':17A 'com.fasterxml.jackson.core':22A,26A,46A 'cve':11A,19A 'databind':3A,25A,29A,33A,37A,41A,45A,49A 'deseri':5A 'dns':8A 'eager':7A 'fasterxml':34A,38A,42A 'ghsa':15A 'ghsa-hgj6':14A 'hgj6':16A 'inetsocketaddress':4A 'jackson':2A,24A,28A,32A,36A,40A,44A,48A 'jackson-databind':1A,23A,27A,31A,35A,39A,43A,47A 'r7m5':18A 'resolut':9A 'ssrf':10A 'tools.jackson.core':30A 'trigger':6A","search_b":"'-918':51B 'applic':86B 'attack':82B 'bind':64B 'boot':59B 'choos':94B 'cwe':50B 'databind':54B,63B 'dns':78B,89B 'field':73B 'forc':84B 'forgeri':104B 'hostnam':76B,92B 'inetsocketaddress':72B 'intern':107B 'jackson':53B,62B 'jackson-databind':52B,61B 'java':55B 'json':66B 'packag':56B 'pars':80B 'probe':106B 'queri':90B 'request':103B 'resolv':75B,108B 'send':88B 'server':101B 'server-sid':100B 'side':102B 'spring':58B 'spring-boot':57B 'type':69B 'untrust':65B 'use':98B","search_c":"'-04':264C '-06':263C '-2.21':230C '-918':252C '1f5a103':221C '2.18':222C '2.18.0':224C '2.18.8':225C,228C,266C '2.19':229C '2.19.0':232C '2.21.4':233C,236C,267C '2026':262C '3':237C '3.0.0':240C '3.1.4':241C,244C,268C '5951':257C 'affect':213C 'applic':131C,155C 'application-level':154C 'arasaratnam':271C 'attack':146C,175C,191C 'attacker-chosen':145C,190C 'band':204C 'base':200C 'bear':182C 'bind':133C,212C 'chosen':147C,192C 'connect':159C,172C 'construct':111C 'contain':139C,219C 'control':176C 'credit':269C 'cwe':246C,251C 'defer':167C 'deseri':128C,178C,195C,260C 'dns':121C,148C,168C,187C,199C 'dns-base':198C 'eager':120C 'explicit':171C 'fasterxml/jackson-databind':256C 'field':142C 'finder':273C 'fix':162C,226C,234C,242C,255C 'forc':185C 'git':217C 'host':116C,165C 'hostnam':125C,193C 'impact':173C 'improv':258C 'inetsocketaddress':112C,115C,141C,181C,259C 'inetsocketaddress.createunresolved':164C 'input':126C 'interact':205C 'intern':207C 'internal-resolv':206C 'issu':143C 'jdkfromstringdeseri':110C 'json':135C,177C 'level':156C 'line':223C,231C,239C 'logic':160C 'lookup':188C 'low':250C 'maintain':247C 'minor':248C 'name':122C 'new':114C 'omkhar':270C,272C 'out-of-band':201C 'outbound':186C 'patch':214C 'perform':119C 'port':117C,166C 'probe':209C 'pure':210C 'queri':149C 'readvalu':151C 'releas':261C 'report':249C 'resolut':123C 'resolv':208C 'sever':245C 'ssrf':197C,253C 'summari':109C 'tag':218C 'time':129C,196C 'type':138C,183C 'untrust':134C 'upstream':254C 'use':163C 'valid':157C 'verifi':215C 'via':216C 'x':238C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-06-16T01:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-hgj6-7826-r7m5","url":"https://github.com/advisories/GHSA-hgj6-7826-r7m5","severity":"medium","published_at":"2026-06-23T21:22:54+00:00","modified_at":"2026-11-10T19:33:46+00:00","first_seen_at":"2026-11-10T19:34:54+00:00","fetched_at":"2026-11-10T19:40:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-54514","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54514","severity":null,"published_at":"2026-06-23T21:17:02+00:00","modified_at":"2026-10-25T23:10:00+00:00","first_seen_at":"2026-11-10T20:15:32+00:00","fetched_at":"2026-11-10T20:15:32+00:00","note":null}],"documents":[{"id":117583,"url":"https://api.github.com/repos/FasterXML/jackson-databind/security-advisories/GHSA-hgj6-7826-r7m5","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":117584,"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-16T01:18:12+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":117585,"url":"https://github.com/FasterXML/jackson-databind/pull/5951","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117586,"url":"https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00368,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-54514"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}