CVE-2026-77310 in jackson-databind
Summary
by MITRE • 08/24/2026
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The Jackson Data Processor library serves as a foundational component for Java-based applications requiring robust data binding and tree-model functionality. It is widely adopted across enterprise ecosystems to serialize and deserialize JSON content into Java objects. Within this ecosystem, the FromStringDeserializer plays a critical role in converting string representations of various types back into their corresponding object instances during deserialization processes. Specifically, the java.net.InetAddress branch of the FromStringDeserializer.Std._deserialize() method has historically relied on standard Java networking APIs to resolve hostnames and IP addresses provided within incoming JSON payloads. This functionality is essential for applications that need to process network-related data structures but introduces significant security implications when handling untrusted input without adequate validation or sanitization mechanisms in place prior to version 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines.
The core technical flaw lies in the eager execution of InetAddress.getByName() when processing attacker-controlled input during deserialization. When a malicious actor supplies a specially crafted JSON payload containing a hostname or IP address string that triggers this specific code path, the library immediately attempts to resolve the provided value against DNS servers. This behavior occurs before any application-level business logic can intervene or validate the intent of the data. The lack of lazy evaluation or pre-validation means that every deserialization operation involving network addresses results in an outbound DNS query initiated by the server hosting the vulnerable Jackson instance. This mechanism effectively transforms a standard data processing routine into a vector for malicious activity, as the application becomes an unwitting proxy for external attackers seeking to interact with internal infrastructure.
This vulnerability enables several severe operational impacts, primarily centered around Server-Side Request Forgery and network reconnaissance. By controlling the input passed to InetAddress.getByName(), an attacker can force the vulnerable server to make DNS requests to arbitrary domains or internal hostnames that are not accessible from the public internet. This facilitates DNS-based SSRF attacks where the attacker leverages the application's outbound connection capabilities to probe internal networks, bypassing traditional perimeter security controls such as firewalls and web application firewalls that typically restrict direct external access to sensitive services. Furthermore, this behavior allows for precise internal-host enumeration. Attackers can systematically iterate through common internal hostnames or IP ranges, observing response times or error messages in the deserialization process to determine which hosts are active and responsive within the private network topology. This information gathering is often a precursor to more targeted attacks against specific services running on those identified hosts.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) due to its ability to induce the server to make requests to unintended destinations based on user input. It also relates to CWE-20 Improper Input Validation because the library fails to adequately restrict or validate the format and intent of network address strings before processing them. In terms of adversary tactics, this behavior maps directly to ATT&CK technique T1557 Adversary-in-the-Middle, specifically the LLMNR/NBT-NS Poisoning and SMB Relay sub-tactics if used in conjunction with other exploits, but more broadly fits within T1046 Network Service Discovery as it allows attackers to map internal network services through DNS queries. The vulnerability is particularly dangerous because it does not require authentication or complex exploitation chains; a simple JSON payload sent via any API endpoint that utilizes Jackson for deserialization can trigger the malicious behavior.
Mitigation strategies must prioritize immediate software updates and architectural changes. Organizations running affected versions of Jackson Data Processor should upgrade to version 2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1 immediately, as these releases contain the necessary patches that prevent eager DNS resolution during deserialization. The fix likely involves modifying the InetAddress handling logic to either disable automatic hostname resolution for untrusted input or to implement strict allow-listing of permitted hostnames and IP ranges before any network operations are initiated. In addition to patching, developers should audit their codebases for custom Deserializers that might replicate this pattern and apply similar safeguards. Implementing a Web Application Firewall with SSRF protection rules can provide an additional layer of defense by monitoring outbound DNS traffic from application servers and blocking requests to suspicious or internal IP ranges. Regular security assessments and static analysis tools configured to detect unsafe deserialization practices should also be employed to identify potential entry points for such attacks in the future, ensuring that data binding libraries are used with appropriate context awareness regarding trust boundaries.