What’s Vulnerable › Vulnerabilities
CVE-2026-77310: jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-24 · updated 2026-10-12
- Weakness: CWE-918
Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Affected products
- Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.0.0 before 2.18.9; from 2.19.0 before 2.21.5; from 2.22.0 before 2.22.1; 2.0.0, 2.0.1, 2.0.2, 2.0.4, 2.0.5, 2.0.6 (+216) — fixed in 2.18.9, 2.21.5, 2.22.1
- Maven Tools.Jackson.Core:Jackson-Databind: from 3.0.0 before 3.1.5; from 3.2.0 before 3.2.1; 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0 (+6) — fixed in 3.1.5, 3.2.1
- FasterXML com.fasterxml.jackson.core:jackson-databind: from 2.0.0, < 2.18.9; from 2.19.0, < 2.21.5; from 2.22.0, < 2.22.1
- FasterXML tools.jackson.core:jackson-databind: from 3.0.0, < 3.1.5; from 3.2.0, < 3.2.1
How to fix
Upgrade to a fixed version: Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.18.9, 2.21.5, 2.22.1; Maven Tools.Jackson.Core:Jackson-Databind 3.1.5, 3.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-77310 or the next vulnerability affects your stack