CVE-2026-54514 jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

What is CVE-2026-54514?

CVE-2026-54514 is a medium-severity server-side request forgery vulnerability in Fasterxml Jackson-Databind, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Weakness: CWE-918

Which versions are affected by CVE-2026-54514?

10 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind. It affects 1 product.

Products include Fasterxml Jackson-Databind.

How do I fix CVE-2026-54514?

Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.18.8, 2.21.4 or 3.1.4.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-54514 being exploited?

There is no known exploitation of CVE-2026-54514 in the wild and no public exploit code.

Other vulnerabilities in Fasterxml Jackson-Databind

• CVE-2018-11307 Deserialization of Untrusted Data in jackson-databind Critical 9.8
• CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation High 8.1
• CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) High 8.1
• CVE-2020-14060 Deserialization of untrusted data in Jackson Databind High 8.1
• CVE-2021-46877 jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode High 7.5

All Fasterxml Jackson-Databind vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-BX77737, CLEANSTART-2026-DC64340, CLEANSTART-2026-ED66251, CLEANSTART-2026-EG13958, CLEANSTART-2026-FF14094, CLEANSTART-2026-FR49757 and 134 more.