CVE-2026-54514 Details
Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
A vulnerability in Jackson Databind's deserialization of InetSocketAddress objects has been identified. In versions 2.0.0 prior to 2.18.8, 2.21.4, and 3.0.0 prior to 3.1.4, the JDKFromStringDeserializer class used new InetSocketAddress(host, port) to create InetSocketAddress instances. This approach performs immediate DNS resolution for hostname inputs during deserialization. As a result, an application that processes untrusted JSON into a type with an InetSocketAddress field inadvertently triggers an attacker-controlled DNS query at the deserialization stage, before any application-specific validation or connection logic is applied. The vulnerability allows for Server-Side Request Forgery (SSRF) by forcing outbound DNS lookups for chosen hostnames, potentially probing internal resolvers.
Users can upgrade to Jackson Databind versions 2.18.8, 2.21.4, or 3.1.4, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| fasterxml jackson-databind | >= 2.0.0, < 2.18.8 >= 2.19.0, < 2.21.4 >= 3.0.0, < 3.1.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 27, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |