CVE-2026-77310

Name of the Vulnerable Software and Affected Versions jackson-databind versions prior to 2.18.9 jackson-databind versions prior to 2.21.5 jackson-databind versions prior to 2.22.1 jackson-databind versions prior to 3.1.5 jackson-databind versions prior to 3.2.1

Description The java.net.InetAddress branch of the FromStringDeserializer.Std. deserialize() function calls InetAddress.getByName() using input controlled by an attacker. This leads to eager DNS resolution during deserialization, which allows for internal-host enumeration and DNS-based server-side request forgery (SSRF), a technique where an attacker induces a server to make requests to an unintended location.

Recommendations Update to version 2.18.9 Update to version 2.21.5 Update to version 2.22.1 Update to version 3.1.5 Update to version 3.2.1