Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-24T20:17:20.977Z",
  "pubdate": "2026-08-24T20:17:20.977Z",
  "executiveSummary": "A vulnerability exists in jackson-databind related to eager DNS resolution during deserialization, classified as a Server-Side Request Forgery (SSRF) and internal-host enumeration vulnerability. The flaw impacts the jackson-databind library across multiple release lines prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.\nThe vulnerability allows an attacker with control over the input data processed by the application to trigger unauthorized DNS queries. This enables DNS-based server-side request forgery and facilitates the enumeration of internal network hosts.\nExploitation requires the application to process untrusted serialized payloads containing attacker-controlled data directed at the vulnerable component. Successful exploitation poses risks regarding internal network topology exposure and potential network-based pivoting or reconnaissance.",
  "technicalDetails": "The root cause of the vulnerability resides within the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() inside jackson-databind. During the data-binding and deserialization process, this function executes InetAddress.getByName() directly on attacker-controlled input strings.\nBecause the deserialization routine executes this resolution synchronously and eagerly, supplying a specific payload forces the underlying Java runtime to perform a network resolution request for the specified domain or IP address.\nThe vulnerable component is the FromStringDeserializer.Std._deserialize() method handling java.net.InetAddress types. Affected software versions include all versions prior to 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines.\nThe attack flow proceeds as follows: 1) An attacker constructs a malicious serialized payload containing a targeted hostname or IP address intended for internal-host enumeration or out-of-band communication. 2) The victim application receives and attempts to deserialize the untrusted payload using jackson-databind. 3) During deserialization, FromStringDeserializer.Std._deserialize() intercepts the target string and invokes InetAddress.getByName(). 4) The host operating system executes an eager DNS query to resolve the supplied identifier, leaking information or enabling DNS-based SSRF vectors.\nNo authentication or elevated privileges are strictly required beyond the ability to supply untrusted data to an endpoint or service that processes it using the vulnerable jackson-databind configuration. Network exposure depends on the application's attack surface accepting external serialization inputs."
}