Denial of Service Vulnerability in Jackson Databind by FasterXML
CVE-2026-54514
5.3MEDIUM
What is CVE-2026-54514?
The Jackson Databind library, used for data-binding functionality, is vulnerable to a Denial of Service attack when deserializing untrusted JSON input. Specifically, the InetSocketAddress constructor performs DNS name resolution eagerly upon deserialization, which can allow an attacker to leverage untrusted data to cause unwanted DNS queries. This vulnerability impacts versions 2.0.0 through 2.18.8, 2.21.4, and 3.1.4. The issue is resolved in the latest releases where DNS resolution is deferred until an explicit connect is invoked, enhancing application security and reliability.
Affected Version(s)
jackson-databind >= 2.0.0, < 2.18.8 < 2.0.0, 2.18.8
jackson-databind >= 2.19.0, < 2.21.4 < 2.19.0, 2.21.4
jackson-databind >= 3.0.0, < 3.1.4 < 3.0.0, 3.1.4