CVE-2026-77310
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
com.fasterxml.jackson.core:jackson-databind
- Vendor
- FasterXML
- Product
- com.fasterxml.jackson.core:jackson-databind
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| >= 2.0.0, < 2.18.9 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 2.19.0, < 2.21.5 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 2.22.0, < 2.22.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
tools.jackson.core:jackson-databind
- Vendor
- FasterXML
- Product
- tools.jackson.core:jackson-databind
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| >= 3.0.0, < 3.1.5 | affected | Unavailable | Unavailable | Unavailable | None listed |
| >= 3.2.0, < 3.2.1 | affected | Unavailable | Unavailable | Unavailable | None listed |