| Package | Affected versions | Patched versions |
|---|---|---|
| com.fasterxml.jackson.core:jackson-databind | ≥ 2.0.0, < 2.18.8≥ 2.19.0, < 2.21.4≥ 3.0.0, < 3.1.4 | 2.18.82.21.43.1.4 |
| tools.jackson.core:jackson-databind | ≥ 2.19.0, < 2.21.4≥ 3.0.0, < 3.1.4 | 2.21.43.1.4 |
| jackson-databind | ≥ 2.0.0, < 2.18.8≥ 2.19.0, < 2.21.4≥ 3.0.0, < 3.1.4 | 2.18.82.21.43.1.4 |
JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect.
An attacker controlling JSON deserialized into an InetSocketAddress-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.
git tag --contains on 1f5a103)>= 2.18.0, < 2.18.8 -> fixed in 2.18.8>= 2.19.0, < 2.21.4 -> fixed in 2.21.4>= 3.0.0, < 3.1.4 -> fixed in 3.1.4Maintainer: minor. Reporter: LOW. CWE-918 (SSRF).
FasterXML/jackson-databind#5951 ("Improve InetSocketAddress deserialization"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.
Omkhar Arasaratnam (@omkhar) - finder.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free