CVE-2026-54514: Jackson Databind SSRF Vulnerability

CVE-2026-54514 Overview

CVE-2026-54514 affects jackson-databind, the general-purpose data-binding library for the Jackson Data Processor. The flaw resides in JDKFromStringDeserializer, which constructs InetSocketAddress instances using new InetSocketAddress(host, port). This constructor performs eager DNS resolution on attacker-controlled hostnames during deserialization, before any application validation runs. An attacker who can submit JSON to an endpoint that binds into a type containing an InetSocketAddress field can trigger arbitrary DNS lookups through readValue. The issue is classified as a Server-Side Request Forgery weakness [CWE-918] and is fixed in versions 2.18.8, 2.21.4, and 3.1.4.

Critical Impact
Untrusted JSON deserialization triggers attacker-chosen DNS queries from the host running jackson-databind, enabling DNS-based exfiltration, internal network reconnaissance, and interaction with DNS-driven SSRF chains.

Affected Products

FasterXML jackson-databind 2.x from 2.0.0 through versions prior to 2.18.8
FasterXML jackson-databind 2.x prior to 2.21.4
FasterXML jackson-databind 3.x prior to 3.1.4

Discovery Timeline

2026-06-23 - CVE-2026-54514 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54514

Vulnerability Analysis

The vulnerability lives in JDKFromStringDeserializer, the deserializer Jackson uses to convert JSON string values into JDK types such as InetSocketAddress. When Jackson binds an incoming JSON value into a class field of type InetSocketAddress, it parses the host and port and calls new InetSocketAddress(host, port). That constructor immediately performs a DNS lookup on host to populate the address. Resolution happens inside readValue, before the application sees the object or applies allow-list checks.

An attacker who controls the JSON payload controls the hostname passed to the resolver. The host running the application then issues DNS queries to attacker-chosen names. Resolvers commonly forward those queries to authoritative servers controlled by the attacker, who can record source IP, timing, and arbitrary subdomain labels. This produces a DNS-based Server-Side Request Forgery primitive [CWE-918] usable for data exfiltration over DNS, internal asset discovery via split-horizon resolvers, and chaining with downstream connect logic.

Root Cause

The root cause is the use of the resolving InetSocketAddress(String, int) constructor inside deserialization. Deserializers must not perform network I/O on untrusted input. The fix replaces the call with InetSocketAddress.createUnresolved(host, port), which stores the hostname without resolving it. DNS resolution is then deferred until an explicit connect call, where application-level validation can run first.

Attack Vector

Exploitation requires only that an application accept untrusted JSON and bind it to a Java type containing an InetSocketAddress field, directly or via polymorphic typing. No authentication or user interaction is required when the deserialization endpoint is reachable over the network. The attacker submits JSON containing a hostname under a domain they control. During ObjectMapper.readValue, the JVM issues DNS lookups against that domain.

text

// Patch reference: release-notes/CREDITS-2.x
 Omkhar Arasaratnam (@omkhar)
  * Reported #5950: Improve `UUIDeserializer` error handling
   (2.18.8)
+ * Reported #5951: Improve `InetSocketAddress` deserialization
+  (2.18.8)

Source: FasterXML/jackson-databind commit 1f5a103

Detection Methods for CVE-2026-54514

Indicators of Compromise

Outbound DNS queries from application hosts to unfamiliar external domains, especially long randomized subdomain labels consistent with DNS exfiltration.
DNS lookups generated during HTTP request processing for endpoints that accept JSON bodies.
Application logs showing ObjectMapper.readValue calls bound to types containing InetSocketAddress fields.

Detection Strategies

Inventory dependencies with mvn dependency:tree or gradle dependencies and flag jackson-databind versions earlier than 2.18.8, 2.21.4, or 3.1.4.
Correlate inbound HTTP requests carrying JSON payloads with outbound DNS resolutions on the same host within a short time window.
Search source code for fields and DTO classes typed as java.net.InetSocketAddress that are populated through Jackson deserialization.

Monitoring Recommendations

Forward resolver logs to a SIEM and alert on application servers issuing DNS queries to newly registered or low-reputation domains.
Monitor for unusually high cardinality of unique subdomains queried from a single application host.
Track Jackson version drift across services via Software Bill of Materials (SBOM) checks in CI.

How to Mitigate CVE-2026-54514

Immediate Actions Required

Upgrade jackson-databind to 2.18.8, 2.21.4, or 3.1.4 depending on the branch in use.
Audit DTOs and polymorphic type configurations for fields of type InetSocketAddress and restrict them where untrusted input is accepted.
Restrict outbound DNS from application servers to an internal resolver that enforces allow-listing and logging.

Patch Information

The fix is tracked in FasterXML jackson-databind PR #5951 and merged in commit 1f5a1037b1e9e05920e755cb35f198bcd46667e4. The patch replaces the resolving constructor with InetSocketAddress.createUnresolved(host, port). Full advisory details are available in GHSA-hgj6-7826-r7m5.

Workarounds

Register a custom deserializer for InetSocketAddress that calls InetSocketAddress.createUnresolved and rejects unexpected hosts.
Remove or replace InetSocketAddress fields in classes that are reachable from untrusted Jackson deserialization paths.
Place application servers behind egress filtering that blocks DNS resolution of external domains not on an allow-list.

bash

# Maven dependency override to enforce fixed version
mvn versions:use-dep-version \
  -Dincludes=com.fasterxml.jackson.core:jackson-databind \
  -DdepVersion=2.18.8 \
  -DforceVersion=true

# Gradle constraint enforcing the patched release
# build.gradle
# dependencies {
#   constraints {
#     implementation('com.fasterxml.jackson.core:jackson-databind:2.18.8') {
#       because 'CVE-2026-54514 InetSocketAddress eager DNS resolution'
#     }
#   }
# }