jackson-databind vulnerabilities

A flaw in jackson-databind before 2.9.10.7 mishandles the interaction between serialization gadgets and typing. The highest threat is to data confidentiality, integrity, and system availability.

jackson-databind, the general-purpose data-binding functionality and tree-model for Jackson Data Processor, prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, has a vulnerability in the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize(). It calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration.

In jackson-databind, the UnwrappedPropertyHandler.processUnwrapped() method replays buffered JSON for a @JsonUnwrapped property without a prop.visibleInView() guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view.

A vulnerability in jackson-databind allows bypassing @JsonIgnore in Java Records using PropertyNamingStrategy. Affected versions from 2.15.0 to 2.18.8, 2.21.4, and 3.1.4 register the ignored field under its original name before applying the naming strategy, enabling the renamed JSON key to be assigned to the Record constructor parameter.

In jackson-databind from version 2.8.0 to 2.18.9, 2.21.5, and 3.1.4, a vulnerability exists where per-property @JsonIgnoreProperties exclusions are applied by removing ignored properties from BeanPropertyMap, but subsequent case-insensitivity processing (ACCEPT_CASE_INSENSITIVE_PROPERTIES) rebuilds the map from the original unfiltered source, restoring the removed properties. The ignored property becomes writable again.

Vulnerability in jackson-databind from version 2.0.0 to 2.18.8, 2.21.4, and 3.1.4 causes immediate DNS resolution for untrusted input during deserialization of InetSocketAddress. An attacker can force a DNS query to a chosen host before any application-level validation.

Jackson-databind from 2.10.0 to 2.18.8, 2.21.4, and 3.1.4 has a vulnerability in BasicPolymorphicTypeValidator where allowIfSubTypeIsArray() allows any array type without validating the element type. This bypasses the allowlist and allows deserialization of dangerous types like EvilType[].

Jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies.