CVE-2026-54514

About vulnerability

Summary

JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect.

Impact

An attacker controlling JSON deserialized into an InetSocketAddress-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.

Affected / Patched (verified via git tag --contains on 1f5a103)

• 2.18 line: >= 2.18.0, < 2.18.8 -> fixed in 2.18.8
• 2.19-2.21 line: >= 2.19.0, < 2.21.4 -> fixed in 2.21.4
• 3.x line: >= 3.0.0, < 3.1.4 -> fixed in 3.1.4

Severity / CWE

Maintainer: minor. Reporter: LOW. CWE-918 (SSRF).

Upstream fix

FasterXML/jackson-databind#5951 (“Improve InetSocketAddress deserialization”). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.

Credits

Omkhar Arasaratnam (@omkhar) - finder.

Affected product:

AlmaLinux 9.2 ESU , Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Apache Struts , Elasticsearch , Gradle , Hazelcast , Hibernate , Jackson , OpenSearch , Spring , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Wildfly , accumulo , activemq , agepredictor , archaius , artemis , avro , aws-java-sdk-xray , aws-sdk-java , aws-xray-sdk-java , azure-sdk-for-java , azure-spring-data-cosmos , bookkeeper , bookkeeper-common-allocator , calcite , camel , cassandra-java-driver , com.wavefront:wavefront-sdk-java , consul-client , corda , couchbase-jvm-clients , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , debezium , distributedlog , docker-java , docx4j , droolsjbpm-integration , etcd4j , eureka , flink , grails-core , grails-data-mapping , grails-gsp , grails-plugin-converters , graphql-java-servlet , groovy , hbase , http-client , hystrix , incubator-retired-htrace , infinispan , jasperreports , java-apns , java-cas-client , java-driver , java-genai , java-jwt , java-opensaml , jersey , jgroups-aws , jjwt , json-patch , json-schema-core , json-schema-validator , jsonpath , jsonschema-generator , karaf , kubernetes-client , logging-flume , micrometer , micrometer-tracing , micronaut-cache , micronaut-core , micronaut-spring , neo4j-ogm , olingo-odata4 , openstack4j , org.apache.groovy:groovy-all , parquet-java , pinecone-java-client , pulsar , pulsar-client-reactive , redisson , rescu , rest-assured , resteasy , ribbon , signalfx-java , smallrye-open-api , swagger-core , swagger-parser , testcontainers-java , tika , tinkerpop , trendrrnsqclient , twilio-java , typesense-java , vert.x , wavefront-internal-reporter-java , web3j , wiremock , ws-wss4j , xchange , zendesk-java-client

Affected packages:

hadoop-annotations @ 2.7.3 (+9851 more)