jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

🗓️ 23 Jun 2026 21:22:54Reported by GitHub Advisory DatabaseType

Jackson databind InetSocketAddress deserialization triggers DNS lookups, enabling SSRF; fix uses createUnresolved.

Reporter	Title	Published	Views	Family All 154
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been detected in IBM Security Verify Governance Identity Manager Adapters	13 Jul 202606:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.	25 Jul 202616:37	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in jackson-databind may affect IBM APM Linux KVM Agent for Virtual Environments.	4 Aug 202608:12	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in jackson-databind	30 Jul 202618:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	7 Jul 202616:27	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been detected in IBM Security Verify Governance Identity Manager Adapters	13 Jul 202606:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j API and jackson-databind	29 Jul 202614:19	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in jackson-databind-2.18.6.jar, protobufjs-8.3.0.tgz and fast-uri-3.1.2.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite which are affected by multiple CVEs	3 Aug 202608:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	8 Jul 202616:15	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jackson-databind, IBM EntireX is vulnerable to multiple vulnerabilities.	3 Aug 202614:45	–	ibm

Vulners

Node

tools.jackson.core jackson-databindRange3.0.0–3.1.4maven

tools.jackson.core jackson-databindRange2.19.0–2.21.4maven

com.fasterxml.jackson.core jackson-databindRange3.0.0–3.1.4maven

com.fasterxml.jackson.core jackson-databindRange2.19.0–2.21.4maven

com.fasterxml.jackson.core jackson-databindRange2.0.0–2.18.8maven

Source	Link
github	www.github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5
github	www.github.com/FasterXML/jackson-databind/pull/5951
github	www.github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54514
github	www.github.com/advisories/GHSA-hgj6-7826-r7m5

20 Jul 2026 21:21Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.3

EPSS0.00219

SSVC

CWE-918