CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-918

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Affected products

FasterXML jackson-databind: from 2.0.0 before 2.18.8; from 2.19.0 before 2.21.4; from 3.0.0 before 3.1.4 — fixed in 2.18.8, 2.21.4, 3.1.4
Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.0.0 before 2.18.8; from 2.19.0 before 2.21.4; from 3.0.0 before 3.1.4; 2.0.0, 2.0.1, 2.0.2, 2.0.4, 2.0.5, 2.0.6 (+213) — fixed in 2.18.8, 2.21.4, 3.1.4
Maven Tools.Jackson.Core:Jackson-Databind: from 2.19.0 before 2.21.4; from 3.0.0 before 3.1.4; 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0 (+4) — fixed in 2.21.4, 3.1.4

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.18.8, 2.21.4, 3.1.4; Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.18.8, 2.21.4, 3.1.4; Maven Tools.Jackson.Core:Jackson-Databind 2.21.4, 3.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-54514 or the next vulnerability affects your stack