Skip to main content

Server-Side Request Forgery (SSRF) in com.fasterxml.jackson.core:jackson-databind

CVE-2026-77310

  • com.fasterxml.jackson.core:jackson-databind
  • tools.jackson.core:jackson-databind
Medium
5.3/10

Summary

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.x prior to versions 2.18.9, 2.19.x prior to 2.21.5, 2.22.x prior to 2.22.1, 3.0.x prior to 3.1.5, and 3.2.x prior to 3.2.1 on their respective release lines, the java.net.InetAddress branch of "FromStringDeserializer.Std._deserialize()" calls "InetAddress.getByName()" on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-918 - Server-Side Request Forgery (SSRF)

Server-side request forgery (SSRF) is a weakness that allows an attacker to send an arbitrary request, making it appear that the request was sent by the server. This request may bypass a firewall that would normally prevent direct access to the URL. The impact of this vulnerability can vary from unauthorized access to files and sensitive information to remote code execution.

References

Advisory Timeline

  • Published