CVE-2026-77310: FasterXML jackson-databind DNS resolution SSRF in InetAddress deserialization

CVE-2026-77310 · Severity: medium · CVSS 5.3 · Published 2026-08-24

jackson-databind is a widely-used Java library for converting JSON and other data formats into Java objects. The library improperly deserializes untrusted input into Java InetAddress objects, triggering immediate DNS lookups against attacker-controlled hostnames before the application has a chance to validate the data. An attacker can exploit this to perform DNS-based denial-of-service attacks, probe internal network hostnames, or exfiltrate data via DNS callbacks.

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-77310 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77310 being exploited in the wild.
How severe is CVE-2026-77310?
Medium severity, with a CVSS score of 5.3, published 24 August 2026.
Which products and versions are affected?
FasterXML Jackson Databind < 2.18.9, >= 2.19.0 and < 2.21.5, >= 2.22.0 and < 2.22.1, >= 3.0.0 and < 3.1.5, >= 3.2.0 and < 3.2.1; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.0.0,fixed=2.18.9; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.5.
Is there a fix for CVE-2026-77310?
Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.9 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77310 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77310?
Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.9 or later
    # set com.fasterxml.jackson.core:jackson-databind to 2.18.9 in your pom.xml or build.gradle
  • tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.5 or later
    # set tools.jackson.core:jackson-databind to 3.1.5 in your pom.xml or build.gradle

Technical details

The vulnerability exists in the FromStringDeserializer.Std._deserialize() method's handling of java.net.InetAddress types. When deserializing a string value into an InetAddress field, the code calls InetAddress.getByName(value) directly on attacker-controlled input, triggering an eager forward DNS lookup at deserialization time, before any application-level validation can occur. A prior partial fix (CVE-2026-54514) addressed the same issue in the sibling InetSocketAddress branch by using createUnresolved(), but this fix was not applied to InetAddress. The vulnerability is reachable through any plain POJO field, polymorphic subtype, or default-typing-permitted slot. An attacker can force outbound DNS requests to arbitrary hostnames, enabling DNS-based SSRF, internal hostname enumeration, and out-of-band data exfiltration. The issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Affected products

  • FasterXML jackson-databind < 2.18.9, >= 2.19.0 and < 2.21.5, >= 2.22.0 and < 2.22.1, >= 3.0.0 and < 3.1.5, >= 3.2.0 and < 3.2.1

Identifiers

  • CVE-2026-77310
  • GHSA-vvgp-rfg2-7rr6

Timeline

  • 2026-08-24: disclosed
  • 2026-08-24: patched: Versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.