CVE-2026-77310
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
jackson-databind, the general-purpose data-binding functionality and tree-model for Jackson Data Processor, prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, has a vulnerability in the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize(). It calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration.
Risk Assessment
The risk includes the possibility of SSRF attacks and internal host enumeration, potentially leading to unauthorized access to internal network resources.
Recommendation
Upgrade jackson-databind to one of the fixed versions: 2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1.
Other vulnerabilities in jackson-databind
See all- CVE-2021-20190High
A flaw in jackson-databind before 2.9.10.7 mishandles the interaction between serialization gadgets and typing. The highest threat is to data confidentiality, integrity, and system availability.
- CVE-2026-59889Medium
In jackson-databind, the UnwrappedPropertyHandler.processUnwrapped() method replays buffered JSON for a @JsonUnwrapped property without a prop.visibleInView() guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view.
- CVE-2026-59888Medium
A vulnerability in jackson-databind allows bypassing @JsonIgnore in Java Records using PropertyNamingStrategy. Affected versions from 2.15.0 to 2.18.8, 2.21.4, and 3.1.4 register the ignored field under its original name before applying the naming strategy, enabling the renamed JSON key to be assigned to the Record constructor parameter.
- CVE-2026-54515Medium
In jackson-databind from version 2.8.0 to 2.18.9, 2.21.5, and 3.1.4, a vulnerability exists where per-property @JsonIgnoreProperties exclusions are applied by removing ignored properties from BeanPropertyMap, but subsequent case-insensitivity processing (ACCEPT_CASE_INSENSITIVE_PROPERTIES) rebuilds the map from the original unfiltered source, restoring the removed properties. The ignored property becomes writable again.
- CVE-2026-54514Medium
Vulnerability in jackson-databind from version 2.0.0 to 2.18.8, 2.21.4, and 3.1.4 causes immediate DNS resolution for untrusted input during deserialization of InetSocketAddress. An attacker can force a DNS query to a chosen host before any application-level validation.
- CVE-2026-54513High
Jackson-databind from 2.10.0 to 2.18.8, 2.21.4, and 3.1.4 has a vulnerability in BasicPolymorphicTypeValidator where allowIfSubTypeIsArray() allows any array type without validating the element type. This bypasses the allowlist and allows deserialization of dangerous types like EvilType[].
- CVE-2023-35116Medium
Jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies.
Original NVD description (English source)
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.