CVE-2026-77310 Security Details

CVE ID

CVE-2026-77310

CWE

CWE-918

CVE Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Published

Aug 21, 2026

CVSS Score & Severity

6.9Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS Score

0%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/fasterxml/jackson/databind/deser/std/FromStringDeserializer$Std._deserialize(Ljava/lang/String;Lcom/fasterxml/jackson/databind/DeserializationContext;)Ljava/lang/Object;

JVMVulnerable params: 0

com/fasterxml/jackson/databind/deser/std/InetAddressDeserializer._deserialize(Ljava/lang/String;Lcom/fasterxml/jackson/databind/DeserializationContext;)Ljava/net/InetAddress;

JVMVulnerable params: 0

com/fasterxml/jackson/databind/deser/std/JdkDeserializers$InetAddressDeserializer._deserialize(Ljava/lang/String;Lcom/fasterxml/jackson/databind/DeserializationContext;)Ljava/net/InetAddress;

JVMVulnerable params: 0

tools/jackson/databind/deser/jdk/JDKFromStringDeserializer._deserialize(Ljava/lang/String;Ltools/jackson/databind/DeserializationContext;)Ljava/lang/Object;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · PR #6058PROJECT