EUVD-2026-65088

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution SSRF still present in InetAddress deserialization...

GHSA-VVGP-RFG2-7RR6 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

Summary CVE-2026-54514 GHSA-hgj6-7826-r7m5 fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deserialization of java.net.InetSocketAddress by switching to InetSocketAddress.createUnresolved... PR 5951, commit 1f5a1037, released in 2.18.8 / 2.21.4 / 3.1.4. That fix did not cover the...

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

Summary CVE-2026-54514 GHSA-hgj6-7826-r7m5 fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deserialization of java.net.InetSocketAddress by switching to InetSocketAddress.createUnresolved... PR 5951, commit 1f5a1037, released in 2.18.8 / 2.21.4 / 3.1.4. That fix did not cover the...

Server-side Request Forgery (SSRF)

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the STDINETADDRESS branch in...