---
id: "CVE-2026-54514"
page: "https://infrastack.ai/live/CVE-2026-54514"
kind: "vulnerability"
aliases: ["CVE-2026-54514", "GHSA-hgj6-7826-r7m5"]
title: "jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)"
severity: "medium"
cvss: 5.3
epss: 0.00368
exploited: false
status: "open"
category: "package"
products: [{"name": "com.fasterxml.jackson.core:jackson-databind", "fixed": ["2.18.8"], "affected": ">= 2.0.0, < 2.18.8", "ecosystem": "maven"}, {"name": "com.fasterxml.jackson.core:jackson-databind", "fixed": ["2.21.4"], "affected": ">= 2.19.0, < 2.21.4", "ecosystem": "maven"}, {"name": "tools.jackson.core:jackson-databind", "fixed": ["3.1.4"], "affected": ">= 3.0.0, < 3.1.4", "ecosystem": "maven"}, {"name": "fasterxml jackson-databind", "fixed": ["2.18.8"], "affected": ">= 2.0.0, < 2.18.8", "ecosystem": "vendor"}, {"name": "fasterxml jackson-databind", "fixed": ["2.21.4"], "affected": ">= 2.19.0, < 2.21.4", "ecosystem": "vendor"}, {"name": "fasterxml jackson-databind", "fixed": ["3.1.4"], "affected": ">= 3.0.0, < 3.1.4", "ecosystem": "vendor"}, {"via": "cpe", "name": "com.fasterxml.jackson.core:jackson-databind", "fixed": ["3.1.4"], "affected": ">= 3.0.0, < 3.1.4", "ecosystem": "maven"}]
ecosystems: ["maven", "vendor"]
tags: ["cwe-918", "jackson-databind", "java", "package", "spring-boot"]
not_affected_if: ["no-inetsocketaddress-fields", "no-untrusted-json-binding"]
published_at: "2026-06-23T21:17:02+00:00"
first_seen_at: "2026-11-10T19:34:54+00:00"
updated_at: "2026-11-10T20:15:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-hgj6-7826-r7m5", "first_seen_at": "2026-11-10T19:34:54+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514", "first_seen_at": "2026-11-10T20:15:32+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00368, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-54514"}]
---

# jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

Link for people: https://infrastack.ai/live/CVE-2026-54514 (this .md is for agents)

When jackson-databind binds untrusted JSON into a type with an InetSocketAddress field, it resolves hostnames through DNS during parsing. An attacker can force the application to send DNS queries for hostnames they choose, which can be used for server-side request forgery or probing internal resolvers.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:com.fasterxml.jackson.core:jackson-databind affected >= 2.0.0, < 2.18.8 fixed 2.18.8
- maven:com.fasterxml.jackson.core:jackson-databind affected >= 2.19.0, < 2.21.4 fixed 2.21.4
- maven:tools.jackson.core:jackson-databind affected >= 3.0.0, < 3.1.4 fixed 3.1.4
- vendor:fasterxml jackson-databind affected >= 2.0.0, < 2.18.8 fixed 2.18.8
- vendor:fasterxml jackson-databind affected >= 2.19.0, < 2.21.4 fixed 2.21.4
- vendor:fasterxml jackson-databind affected >= 3.0.0, < 3.1.4 fixed 3.1.4
- maven:com.fasterxml.jackson.core:jackson-databind affected >= 3.0.0, < 3.1.4 fixed 3.1.4

## How to check

- Check the jackson-databind version in your build file or dependency tree (for example `mvn dependency:tree` or `gradle dependencies`).
- Search your code for classes that bind JSON into fields of type `InetSocketAddress`.

## Fix

- com.fasterxml.jackson.core:jackson-databind 2.18.x: move to `2.18.8`
- com.fasterxml.jackson.core:jackson-databind 2.19.x to 2.21.x: move to `2.21.4`
- tools.jackson.core:jackson-databind 3.x: move to `3.1.4`

## Timeline

- 2026-11-10T19:34:54+00:00 ghsa https://github.com/advisories/GHSA-hgj6-7826-r7m5
- 2026-11-10T20:15:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54514

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/FasterXML/jackson-databind/security-advisories/GHSA-hgj6-7826-r7m5
- [advisory] Maintainer's advisory: github.com https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5
- [fix] Patch: github.com https://github.com/FasterXML/jackson-databind/pull/5951
- [fix] Patch: github.com https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4

## From the sources

## Summary
`JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an `InetSocketAddress` field issues an attacker-chosen DNS query during `readValue`, before any application-level validation or connect logic. The fix uses `InetSocketAddress.createUnresolved(host, port)`, deferring DNS to an explicit connect.

## Impact
An attacker controlling JSON deserialized into an `InetSocketAddress`-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.

## Affected / Patched (verified via `git tag --contains` on `1f5a103`)
- 2.18 line: `>= 2.18.0, < 2.18.8` -> fixed in **2.18.8**
- 2.19-2.21 line: `>= 2.19.0, < 2.21.4` -> fixed in **2.21.4**
- 3.x line: `>= 3.0.0, < 3.1.4` -> fixed in **3.1.4**

## Severity / CWE
Maintainer: minor. Reporter: LOW. CWE-918 (SSRF).

## Upstream fix
FasterXML/jackson-databind#5951 ("Improve InetSocketAddress deserialization"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.

## Credits
Omkhar Arasaratnam (@omkhar) - finder.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_