jackson-databind CVE-2026-77310

Exploitation requires that the target application deserializes attacker-controlled JSON into a Java class that contains at least one field typed as java.net.InetAddress (or a subtype). The endpoint accepting the JSON must be network-accessible to the attacker; the CVSS vector PR:N confirms no authentication or session is required. No special server configuration or non-default feature flag is needed - the vulnerability is in the default deserialization path. Exploitation is bounded: the attacker can only trigger DNS queries and observe them externally; there is no mechanism for reading local files, executing code, or affecting integrity or availability. Applications that use jackson-databind exclusively for types other than InetAddress are not exposed, regardless of how they configure the ObjectMapper.

The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects the bounded but real-world impact: network-reachable, zero-authentication exploitation limited to partial confidentiality loss through DNS-based information leakage. No EPSS data was supplied, and the vulnerability carries no CISA KEV listing and no known public exploit, which is consistent with the moderate score. The practical threat is DNS-based SSRF: an attacker observing a controlled resolver can enumerate internal hostnames, discover segmented infrastructure, and fingerprint internal naming conventions - intelligence useful in multi-stage attacks. While no integrity or availability impact applies, the ubiquity of jackson-databind means the aggregate exposure surface is exceptionally large; virtually any internet-facing Java REST API deserializing JSON could be affected if its data model uses InetAddress fields. The absence of authentication requirements (PR:N, AC:L) means no credential compromise or insider access is needed. The limiting factor - that the target object model must actually contain InetAddress-typed fields - is an application-design dependency that is not universally present, which is the primary reason this does not score higher.

An attacker submits a JSON request body to any endpoint processed by a vulnerable jackson-databind version where the target data class includes a field of type java.net.InetAddress, setting that field's value to a hostname under the attacker's control (e.g., "remoteHost": "attacker-probe.evil.example.com"). The library's FromStringDeserializer immediately calls InetAddress.getByName() on parsing, causing the server to issue an outbound DNS query that the attacker observes on their resolver, confirming the server's IP and enabling iterative enumeration of internal hostnames by probing RFC-1918 reverse-DNS names or internal naming patterns.