CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
Summary JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect.
Impact An attacker controlling JSON deserialized into an InetSocketAddress-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.
Affected / Patched (verified via git tag --contains on 1f5a103) - 2.18 line: >= 2.18.0, < 2.18.8 -> fixed in 2.18.8 - 2.19-2.21 line: >= 2.19.0, < 2.21.4 -> fixed in 2.21.4 - 3.x line: >= 3.0.0, < 3.1.4 -> fixed in 3.1.4
Severity / CWE Maintainer: minor. Reporter: LOW. CWE-918 (SSRF).
Upstream fix FasterXML/jackson-databind#5951 ("Improve InetSocketAddress deserialization"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.
Credits Omkhar Arasaratnam (@omkhar) - finder.
Other sources
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54514?
The severity of CVE-2026-54514 is medium with a score of 5.3.
What type of vulnerability is CVE-2026-54514?
CVE-2026-54514 is a Server-Side Request Forgery (SSRF) vulnerability caused by eager DNS resolution during deserialization.
How do I fix CVE-2026-54514?
To fix CVE-2026-54514, upgrade jackson-databind to version 2.18.9, 2.21.5, or 3.1.5 or later.
Which versions of jackson-databind are affected by CVE-2026-54514?
Versions of jackson-databind from 2.0.0 to 2.18.8, 2.21.4, and 3.1.4 are affected by CVE-2026-54514.
What is the impact of CVE-2026-54514?
The impact of CVE-2026-54514 can allow an attacker to perform unauthorized DNS resolution leading to potential exposure of internal services.