PT-2026-51597 · Unknown · Jackson-Databind

Omkhar · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-54514

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.0.0 through 2.18.7 jackson-databind versions 2.19.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3

Description The JDKFromStringDeserializer function constructs InetSocketAddress using new InetSocketAddress(host, port), which triggers eager DNS name resolution for hostname inputs during deserialization. When an application binds untrusted JSON into a type containing an InetSocketAddress field, it issues an attacker-chosen DNS query during the readValue process, occurring before any application-level validation or connection logic. This can lead to Server-Side Request Forgery (SSRF), where an attacker forces outbound DNS lookups for chosen hostnames to perform out-of-band interaction or internal-resolver probing.

Recommendations Update to version 2.18.8 for versions in the 2.18 line. Update to version 2.21.4 for versions in the 2.19 through 2.21 line. Update to version 3.1.4 for versions in the 3.x line.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-54514

GHSA-HGJ6-7826-R7M5

Affected Products

Jackson-Databind

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-54514 · Security Note
• https://osv.dev/vulnerability/GHSA-hgj6-7826-r7m5 · Vendor Advisory
• https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4 · Note
• https://github.com/FasterXML/jackson-databind/pull/5951 · Note
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5 · Note
• https://github.com/FasterXML/jackson-databind · Note