Skip to main content

jackson-databind CVE-2026-54514

| EUVDEUVD-2026-38592 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-06-23 security-advisories@github.com GHSA-hgj6-7826-r7m5
Deserialization SSRF Red Hat Suse Jackson Databind Fasterxml
5.3
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
5.3 MEDIUM

Network-reachable endpoint, no auth required; impact is DNS-based information leakage only, with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

3
Patch available
Jun 23, 2026 - 22:02 EUVD
Source Code Evidence Fetched
Jun 23, 2026 - 21:35 vuln.today
Analysis Generated
Jun 23, 2026 - 21:35 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 283 maven packages depend on com.fasterxml.jackson.core:jackson-databind (50 direct, 235 indirect)

Ecosystem-wide dependent count for version 2.0.0.

DescriptionCVE.org

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

AnalysisAI

Eager DNS resolution during InetSocketAddress deserialization in jackson-databind (versions 2.0.0 through pre-fix releases across the 2.18, 2.21, and 3.x lines) allows any attacker who can supply untrusted JSON to an affected endpoint to force outbound DNS lookups for attacker-chosen hostnames at readValue() time - before application validation or connect logic can intervene. This DNS-based SSRF (CWE-918) enables internal resolver probing, network topology enumeration, and DNS out-of-band interaction signals against applications that deserialize untrusted JSON into types containing InetSocketAddress fields. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence sources.

Technical ContextAI

jackson-databind (Maven: com.fasterxml.jackson.core:jackson-databind) is the primary JSON data-binding library in the Java ecosystem, widely embedded in Spring Boot and other Java frameworks. The vulnerable code path is in JDKFromStringDeserializer within FromStringDeserializer.java. When deserializing a string such as 'hostname:port' into an InetSocketAddress, the library called the JDK constructor new InetSocketAddress(host, port), which synchronously resolves the hostname via the JVM's DNS stack at object-construction time. CWE-918 (Server-Side Request Forgery) applies because the library performs an outbound network operation - a DNS query - on behalf of attacker-supplied data, before any application-defined validation can execute. The fix, introduced in PR #5951 (commit 1f5a103), replaces this with InetSocketAddress.createUnresolved(host, port), which stores the hostname as a plain string without performing DNS resolution, deferring resolution to the point of explicit socket connection. The commit diff confirms the one-line change in FromStringDeserializer.java and accompanying test additions verifying that deserialization no longer triggers resolution.

RemediationAI

Upgrade jackson-databind to a fixed release: 2.18.8 for the 2.18.x line, 2.21.4 for the 2.19-2.21 line, or 3.1.4 for the 3.x line - all released 2026-06-04 and confirmed via git tag analysis in GHSA-hgj6-7826-r7m5. The upstream fix is in PR #5951 (commit 1f5a103, https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4), switching InetSocketAddress construction to createUnresolved(). If patching is blocked, audit all data models exposed to untrusted JSON and remove or replace any InetSocketAddress fields with plain String fields, deferring address construction to validated application logic - this eliminates the vulnerable deserialization path entirely. A secondary compensating control is DNS egress filtering on application servers: blocking or logging unexpected outbound DNS queries to non-approved resolvers will not prevent the DNS query attempt but will limit attacker visibility into internal topology and provide detection coverage. Note that DNS filtering may break legitimate hostname resolution used elsewhere in the application and requires careful allowlisting before deployment.

More in Jackson Databind

View all
CVE-2020-11113 HIGH
8.8 Mar 31

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9548 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35728 HIGH
8.1 Dec 27

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35491 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9547 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35490 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-36183 HIGH POC
8.1 Jan 07

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2022-42004 HIGH POC
7.5 Oct 02

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeseriali
CVE-2022-42003 HIGH POC
7.5 Oct 02

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of
CVE-2019-12086 HIGH POC
7.5 May 17

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. Rated high severity (CVSS 7.5)
CVE-2020-25649 HIGH
7.5 Dec 03

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
CVE-2026-59889 MEDIUM POC
6.5 Jul 14

jackson-databind's @JsonView authorization guard is bypassable on deserialization when a property carries both @JsonView

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique Deserialization

View all
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9
CVE-2020-0618 HIGH POC
8.8
CVE-2015-4852 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-54514 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy