CVE-2026-54514
ADVISORY - githubSummary
Summary
JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect.
Impact
An attacker controlling JSON deserialized into an InetSocketAddress-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.
Affected / Patched (verified via git tag --contains on 1f5a103)
- 2.18 line:
>= 2.18.0, < 2.18.8-> fixed in 2.18.8 - 2.19-2.21 line:
>= 2.19.0, < 2.21.4-> fixed in 2.21.4 - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4
Severity / CWE
Maintainer: minor. Reporter: LOW. CWE-918 (SSRF).
Upstream fix
FasterXML/jackson-databind#5951 ("Improve InetSocketAddress deserialization"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
Common Weakness Enumeration (CWE)
Server-Side Request Forgery (SSRF)
GitHub
3.9
CVSS SCORE
5.3mediumDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumChainguard
CGA-4f5q-c77q-qjj3
-
minimos
MINI-2m45-w2hw-w739
-
minimos
MINI-2mv6-c5hj-2rq9
-
minimos
MINI-2x62-65p9-wc5j
-
minimos
MINI-32jv-m6hh-93j7
-
minimos
MINI-378w-p8h4-x75m
-
minimos
MINI-3h73-c35f-qgw6
-
minimos
MINI-3qmx-f44g-85gm
-
minimos
MINI-45qg-qxj2-fm6j
-
minimos
MINI-4gxx-4wmc-w4x9
-
minimos
MINI-4hc9-8cxp-37q5
-
minimos
MINI-4qf2-cxvf-489j
-
minimos
MINI-5gpm-3vpq-q6q9
-
minimos
MINI-5hww-2g6f-c6p2
-
minimos
MINI-5jpg-qj3h-qg72
-
minimos
MINI-5jxg-9w4h-4579
-
minimos
MINI-64p5-x29w-jcgg
-
minimos
MINI-678c-5p3x-6hjq
-
minimos
MINI-7796-wq46-4m89
-
minimos
MINI-83j9-5mwc-w3px
-
minimos
MINI-85v7-h79c-vjvm
-
minimos
MINI-87vh-p363-4fj4
-
minimos
MINI-8c9x-gq52-pvvm
-
minimos
MINI-8fhq-383j-p524
-
minimos
MINI-8mqj-hr6j-59g6
-
minimos
MINI-8r96-wm34-frxx
-
minimos
MINI-8xhp-g89j-wcrv
-
minimos
MINI-953j-vwx8-fc88
-
minimos
MINI-982w-3mxp-2hg6
-
minimos
MINI-9ccf-4rmq-7wrv
-
minimos
MINI-9hj3-7mqm-6f58
-
minimos
MINI-c76x-p8cf-x7r3
-
minimos
MINI-c8pm-gq6c-4jj8
-
minimos
MINI-cjgw-54q3-xh4j
-
minimos
MINI-f237-5jx4-gq62
-
minimos
MINI-f37m-32hf-vhx8
-
minimos
MINI-fm8f-vcfq-43mw
-
minimos
MINI-frh3-c6gp-jwvv
-
minimos
MINI-fvvm-wg4q-cvh7
-
minimos
MINI-g4m7-m5fj-2v3r
-
minimos
MINI-g96r-8v88-x93h
-
minimos
MINI-gx44-pmrg-j57v
-
minimos
MINI-h5mw-3rpj-jmj7
-
minimos
MINI-hwj4-5vhf-xf76
-
minimos
MINI-j23g-7mgg-x946
-
minimos
MINI-j52g-483r-5h8f
-
minimos
MINI-mfrf-xgr2-crgr
-
minimos
MINI-p95q-wv86-g8c9
-
minimos
MINI-pcp3-xxpr-2cgw
-
minimos
MINI-pwqf-cx5p-c453
-
minimos
MINI-q58h-jcqq-jmcx
-
minimos
MINI-q79f-8595-75c3
-
minimos
MINI-q9cr-23j2-3qv9
-
minimos
MINI-q9vg-j5mx-px22
-
minimos
MINI-qcpj-xjv2-4385
-
minimos
MINI-qgr5-2rh3-7v68
-
minimos
MINI-qj6j-58jw-7mrr
-
minimos
MINI-qwmp-33x6-x3r5
-
minimos
MINI-rrg4-gqc3-rrc6
-
minimos
MINI-vq34-3mmh-82cj
-
minimos
MINI-vr37-8f97-3gwh
-
minimos
MINI-w5w6-rm5w-5mvw
-
minimos
MINI-wv8w-wfwr-rpjp
-
minimos
MINI-x2q6-q95r-hcvm
-
minimos
MINI-x3fc-vxv5-6xrp
-
minimos
MINI-x4x6-qrqj-w44m
-
minimos
MINI-x6f2-3g7g-66w7
-
minimos
MINI-xmh2-7x8q-w457
-
minimos
MINI-xp8v-cf8c-jc55
-
minimos
MINI-xxx5-9468-p7v8
-