CVE-2026-77310 jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization
Attackers can trigger DNS-based SSRF and internal host enumeration via deserialization of InetAddress objects in jackson-databind.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77310?
CVE-2026-77310 is a medium-severity server-side request forgery vulnerability in com.fasterxml.jackson.core:jackson-databind, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Weakness: CWE-918
Which versions are affected by CVE-2026-77310?
10 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | From 2.0.0 | 2.18.9 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.0.0 | 2.18.9 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.19.0 | 2.21.5 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.19.0 | 2.21.5 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.22.0 | 2.22.1 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.22.0 | 2.22.1 |
4 more packages
tools.jackson.core:jackson-databind Maven | From 3.0.0 | 3.1.5 |
tools.jackson.core:jackson-databind Maven | From 3.0.0 | 3.1.5 |
tools.jackson.core:jackson-databind Maven | From 3.2.0 | 3.2.1 |
tools.jackson.core:jackson-databind Maven | From 3.2.0 | 3.2.1 |
How do I fix CVE-2026-77310?
Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.18.9, 2.21.5 or 2.22.1.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-77310 being exploited?
There is no known exploitation of CVE-2026-77310 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-GE41148, CLEANSTART-2026-HU97790, CLEANSTART-2026-LY52990, CLEANSTART-2026-MD90103, CLEANSTART-2026-OD02646, CLEANSTART-2026-QT94444 and 131 more.