CVE-2026-54514

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

• CWE-918

• https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4Patch
• https://github.com/FasterXML/jackson-databind/pull/5951Issue Tracking, Patch
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5Vendor Advisory

Published

Jun 23, 2026

Last Modified

Jun 27, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5450Calling the scanf family of functions with a %mc (malloc'd c…9.8
• CVE-2026-54500Oj (Optimized JSON) is a JSON parser and Object marshaller p…5.3
• CVE-2026-54502Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-5451The Extensions for Leaflet Map plugin for WordPress is vulne…6.4
• CVE-2026-54512jackson-databind contains the general-purpose data-binding f…8.1
• CVE-2026-54513jackson-databind contains the general-purpose data-binding f…8.1
• CVE-2026-54515jackson-databind contains the general-purpose data-binding f…5.3
• CVE-2026-54516jackson-databind contains the general-purpose data-binding f…5.3
• CVE-2026-54517jackson-databind contains the general-purpose data-binding f…5.3
• CVE-2026-54518jackson-databind contains the general-purpose data-binding f…6.5
• CVE-2026-5452A flaw has been found in UCC CampusConnect App up to 14.3.5 …3.3
• CVE-2026-54522MessagePack for Ruby is an implementation of the MessagePack…5.4