Eager DNS Resolution Vulnerability in Jackson Databind by FasterXML
CVE-2026-77310

5.3MEDIUM

Key Information:

Vendor

Fasterxml

Status
Com.fasterxml.jackson.core:jackson-databind
Tools.jackson.core:jackson-databind
Vendor
CVE Published:
24 August 2026

What is CVE-2026-77310?

The Jackson Databind library prior to specified versions has a vulnerability due to the way it handles deserialization of user-controlled input. The method FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() without proper sanitation, which can lead to unexpected DNS resolutions. This allows attackers to perform DNS-based server-side request forgery and enumerate internal hosts, potentially exposing sensitive information and system internals to unauthorized access. The issue has been addressed in recent updates.

Affected Version(s)

com.fasterxml.jackson.core:jackson-databind >= 2.0.0, < 2.18.9 < 2.0.0, 2.18.9

com.fasterxml.jackson.core:jackson-databind >= 2.19.0, < 2.21.5 < 2.19.0, 2.21.5

com.fasterxml.jackson.core:jackson-databind >= 2.22.0, < 2.22.1 < 2.22.0, 2.22.1

References

https://github.com/FasterXML/jackson-databind/security/ad...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.