GHSA-VVGP-RFG2-7RR6 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

Summary CVE-2026-54514 GHSA-hgj6-7826-r7m5 fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deserialization of java.net.InetSocketAddress by switching to InetSocketAddress.createUnresolved... PR 5951, commit 1f5a1037, released in 2.18.8 / 2.21.4 / 3.1.4. That fix did not cover the...

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

Summary CVE-2026-54514 GHSA-hgj6-7826-r7m5 fixed an eager-DNS-resolution / SSRF issue in jackson-databind's deserialization of java.net.InetSocketAddress by switching to InetSocketAddress.createUnresolved... PR 5951, commit 1f5a1037, released in 2.18.8 / 2.21.4 / 3.1.4. That fix did not cover the...

CVE-2023-43208_Detection_PoC

CVE-2023-43208DetectionPoC Use java.net.InetAddress for detection POST /api/users HTTP/1.1 Host: ip:8443 User-Agent: Mozilla/5.0 X11; CrOS x8664 14541.0.0 AppleWebKit/537.36 KHTML, like Gecko Chrome/120.0.0.0 Safari/537.36 Connection: keep-alive Content-Length: 1964 Content-Type: application/xml...

CVE-2026-77310

A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability by providing specially crafted input during data deserialization, specifically when java.net.InetAddress objects are processed. This causes the application to perform eager DNS resolution on attacker-controlled...

SUSE CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the STDINETADDRESS branch in FromStringDeserializer in src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java. An attacker can trigger outbound DNS lookups and blind...

Server-side Request Forgery (SSRF)

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the STDINETADDRESS branch in...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310

jackson-databind (FasterXML Jackson Data Processor) is affected by an incomplete fix for CVE-2026-54514. The java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization. Th...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310 jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

PT-2026-81010

Name of the Vulnerable Software and Affected Versions jackson-databind versions prior to 2.18.9 jackson-databind versions prior to 2.21.5 jackson-databind versions prior to 2.22.1 jackson-databind versions prior to 3.1.5 jackson-databind versions prior to 3.2.1 Description The java.net.InetAddres...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization of the springjsonheadertypes message header by the JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper. An attacker can cause arbitrary DNS resolution requests by injecting a craft...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the default ObjectInputFilter. An attacker can trigger DNS-based information disclosure by sending a Java-serialized payload that deserializes into a collection such as HashMap containing...

SUSE-SU-2024:1499-2 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: - CVE-2024-21011: Fixed denial of service due to long Exception message logging JDK-8319851,bsc1222979 - CVE-2024-21012: Fixed unauthorized data modification due HTTP/2 client improper reverse DNS lookup JDK-8315708,bsc1222987 -...

SUSE CVE-2013-2417

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to Networking. NOTE: the...

SSRF via IPv6 address 2

Description While searching online, I found that https://stackoverflow.com/questions/53764109/is-there-a-java-api-that-will-identify-the-ipv6-address-fd00-as-local-private also states fc00 / fd00 are also private IPv6 range that are weirdly not covered by INetAddress, meaning that it has to be do...

Information Disclosure

Oracle Java SE is vulnerable to information disclosure vulnerability. The vulnerability exists in the Java Runtime Environment JRE component in Oracle Java SE because the Network component does not properly perform InetAddress serialization. Remote attackers could obtain sensitive information and...

UEditor SSRF漏洞(JSP版本)分析与复现

作者： 浮萍@猎户安全实验室 公众号：猎户安全实验室 前些时间测试的时候遇到了一个系统采用了UEditor编辑器，版本为1.4.3。已知该编辑器v1.4.3版本存在SSRF漏洞，虽然是Bool型的SSRF，除了可以进行内网探测外，也可以根据web应用指纹信息，之后进行进一步的测试。 0x01 前言 查看官方的更新日志可以发现UEditor编辑器在版本1.4.3.1修复了SSRF漏洞。...

OpenJDK: Network InetAddress serialization information disclosure (Networking, 8000724)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to Networking. NOTE: the...