CVE-2026-54514
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Vulnerability in jackson-databind from version 2.0.0 to 2.18.8, 2.21.4, and 3.1.4 causes immediate DNS resolution for untrusted input during deserialization of InetSocketAddress. An attacker can force a DNS query to a chosen host before any application-level validation.
Risk Assessment
The organization is exposed to DNS exfiltration or internal network scanning attacks via attacker-controlled DNS queries, potentially leading to data leakage or infrastructure mapping.
Recommendation
Immediately update jackson-databind to version 2.18.8, 2.21.4, or 3.1.4, depending on the branch used, to defer DNS resolution until an explicit connection.
Other vulnerabilities in jackson-databind
See all- CVE-2021-20190High
A flaw in jackson-databind before 2.9.10.7 mishandles the interaction between serialization gadgets and typing. The highest threat is to data confidentiality, integrity, and system availability.
- CVE-2026-77310Medium
jackson-databind, the general-purpose data-binding functionality and tree-model for Jackson Data Processor, prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, has a vulnerability in the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize(). It calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration.
- CVE-2026-59889Medium
In jackson-databind, the UnwrappedPropertyHandler.processUnwrapped() method replays buffered JSON for a @JsonUnwrapped property without a prop.visibleInView() guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view.
- CVE-2026-59888Medium
A vulnerability in jackson-databind allows bypassing @JsonIgnore in Java Records using PropertyNamingStrategy. Affected versions from 2.15.0 to 2.18.8, 2.21.4, and 3.1.4 register the ignored field under its original name before applying the naming strategy, enabling the renamed JSON key to be assigned to the Record constructor parameter.
- CVE-2026-54515Medium
In jackson-databind from version 2.8.0 to 2.18.9, 2.21.5, and 3.1.4, a vulnerability exists where per-property @JsonIgnoreProperties exclusions are applied by removing ignored properties from BeanPropertyMap, but subsequent case-insensitivity processing (ACCEPT_CASE_INSENSITIVE_PROPERTIES) rebuilds the map from the original unfiltered source, restoring the removed properties. The ignored property becomes writable again.
- CVE-2026-54513High
Jackson-databind from 2.10.0 to 2.18.8, 2.21.4, and 3.1.4 has a vulnerability in BasicPolymorphicTypeValidator where allowIfSubTypeIsArray() allows any array type without validating the element type. This bypasses the allowlist and allows deserialization of dangerous types like EvilType[].
- CVE-2023-35116Medium
Jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies.
Original NVD description (English source)
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.