CVE-2026-77310

Overview

jackson-databind is the data-binding package of the FasterXML Jackson suite. It provides the ObjectMapper API that converts JSON and other supported formats to and from Java objects, together with the tree model and the standard serializers and deserializers for common JDK types, and it builds on the low-level streaming parser and generator supplied by jackson-core.

A Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-77310) has been identified in the standard string-like type deserializer used for java.net.InetAddress values, which allows attackers to force the server to perform forward DNS lookups on attacker-chosen names during deserialization, enumerating internal hosts and exfiltrating data through the resolver before any application-level validation runs.

Per OWASP: In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.

This issue affects the standard JDK type deserializers of Jackson.

‍

Details

Module Info

• Product: Jackson
• Affected packages: com.fasterxml.jackson.core:jackson-databind
• Affected versions: >=2.0.0 <2.18.9, >=2.19.0 <2.21.5, >=2.22.0 <2.22.1
• GitHub repository: https://github.com/FasterXML/jackson-databind
• Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-databind
• Package manager: Maven
• Fixed in:
  
  • NES for Jackson 2.13.11, 2.14.8, and 2.15.9
  • OSS jackson-databind 2.18.9, 2.21.5, and 2.22.1

Vulnerability Info

This Medium-severity vulnerability is found in the com.fasterxml.jackson.core:jackson-databind package in the standard JDK type deserializers of Jackson.

java.net.InetAddress is registered as a standard string-like scalar type, so any target slot typed as an InetAddress is bound by the shared FromStringDeserializer.Std handler. In the affected releases the InetAddress branch of that handler hands the incoming JSON string straight to the JDK resolver:

@Override
protected Object _deserialize(String value, DeserializationContext ctxt) throws IOException
{
    switch (_kind) {
    ...
    case STD_TIME_ZONE:
        return TimeZone.getTimeZone(value);
    case STD_INET_ADDRESS:
        return InetAddress.getByName(value);
    case STD_INET_SOCKET_ADDRESS:
        ...
    }
    VersionUtil.throwInternal();
    return null;
}

InetAddress.getByName performs an eager forward DNS lookup whenever the argument is not already an IP address literal, and it is reached with no prior validation of the string. A POJO field, a polymorphic subtype, or any default-typing-permitted slot declared as an InetAddress is therefore enough to turn a single deserialized JSON string into an outbound name resolution chosen entirely by the requester.

That resolution is the attack primitive. Because DNS queries traverse the server's own resolver, an attacker can probe which internal names exist by observing response timing and error behavior, and can smuggle data out of a network that blocks ordinary outbound HTTP by encoding it into the labels of a hostname pointing at a nameserver they control. The lookup happens during parsing, so the request never reaches the code that would have rejected the value.

Validating the string as an IP address literal before resolving it is only effective if the digit test is restricted to ASCII. Java's general-purpose digit classification also accepts non-ASCII numeral forms such as full-width and Arabic-Indic digits, which a lenient literal check would treat as an address while the JDK resolver would not, sending the value back down the DNS path and reinstating the same primitive.

This vulnerability was introduced in 2012 with jackson-databind 2.0.0.

‍

Mitigation

The affected 2.13.x, 2.14.x, and 2.15.x release lines are End-of-Life and will not receive community updates addressing this issue. Branch status is published on the project's own Jackson Releases page.

Users of the affected components should apply one of the following mitigations:

• Upgrade jackson-databind to a currently supported release containing the fix, such as 2.18.9 or later.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• thientd (finder)
• pussycat0x (finder)