Executive brief
jackson-databind is a widely-used Java library for converting JSON and other data formats into Java objects. The library improperly deserializes untrusted input into Java InetAddress objects, triggering immediate DNS lookups against attacker-controlled hostnames before the application has a chance to validate the data. An attacker can exploit this to perform DNS-based denial-of-service attacks, probe internal network hostnames, or exfiltrate data via DNS callbacks.
Technical details
The vulnerability exists in the FromStringDeserializer.Std._deserialize() method's handling of java.net.InetAddress types. When deserializing a string value into an InetAddress field, the code calls InetAddress.getByName(value) directly on attacker-controlled input, triggering an eager forward DNS lookup at deserialization time, before any application-level validation can occur. A prior partial fix (CVE-2026-54514) addressed the same issue in the sibling InetSocketAddress branch by using createUnresolved(), but this fix was not applied to InetAddress. The vulnerability is reachable through any plain POJO field, polymorphic subtype, or default-typing-permitted slot. An attacker can force outbound DNS requests to arbitrary hostnames, enabling DNS-based SSRF, internal hostname enumeration, and out-of-band data exfiltration. The issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Affected products
- FasterXML jackson-databind < 2.18.9, >= 2.19.0 and < 2.21.5, >= 2.22.0 and < 2.22.1, >= 3.0.0 and < 3.1.5, >= 3.2.0 and < 3.2.1
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 released