CVE-2026-77310— jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
Quick assessment
Affected
FasterXML com.fasterxml.jackson.core:jackson-databind
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
jackson-databind 包含 Jackson Data Processor 的通用数据绑定功能和树形模型。在 2.18.9、2.21.5、2.22.1、3.1.5 和 3.2.1 版本之前（分别属于各自发布线）， 方法中的 分支会对攻击者控制的输入调用 ，从而在反序列化期间触发 DNS 解析，进而导致基于 DNS 的服务器端请求伪造（SSRF）以及内部主机枚举。该问题已在版本 2.18.9、2.21.5、2.22.1、3.1.5 和 3.2.1 中得到修复。
Possible ATT&CK Techniques 2 AI
T1048 · Exfiltration Over Alternative Protocol T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77310
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
Source: CVE Program / CVE List V5
Vulnerability Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| FasterXML | com.fasterxml.jackson.core:jackson-databind | >= 2.0.0, < 2.18.9 | - |
|
| FasterXML | tools.jackson.core:jackson-databind | >= 3.0.0, < 3.1.5 | - |
|
II. Public POCs for CVE-2026-77310
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77310
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-77310 (1)
IV. Related Vulnerabilities
Same vendor: FasterXML
-
CVE-2026-68494
jackson-core: Async parser maxNumberLength bypass via chunke -
CVE-2026-18401
jackson-core: Number length constraint bypass in non-blockin -
CVE-2026-59889
jackson-databind: @JsonView ypassed for @JsonUnwrapped conta -
CVE-2026-59888
jackson-databind: @JsonIgnore on a Record property is bypass -
CVE-2026-54518
jackson-databind: @JsonView bypass for unwrapped creator par
Same weakness: CWE-918
-
CVE-2026-78682
NLTK before 3.10.3 SSRF Protection Bypass via Proxy -
CVE-2026-34964
Adminer before 5.5.0 SSRF via PDO DSN Injection -
CVE-2026-76838
Hi.Events before 1.11.1-beta Server-Side Request Forgery via -
CVE-2026-71366
Awx: notification backends allow ssrf and credential leakage -
CVE-2026-78385
RansomLook Analysis PDF Generation Allows Server-Side Reques
V. Comments for CVE-2026-77310
No comments yet