CVE-2026-77310Medium· 5.3▾ Sunlitjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress br…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.3%
Last analysed / modified upstream
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
com.fasterxml.jackson.core:jackson-databind >= 2.0.0, < 2.18.9com.fasterxml.jackson.core:jackson-databind >= 2.19.0, < 2.21.5com.fasterxml.jackson.core:jackson-databind >= 2.22.0, < 2.22.1tools.jackson.core:jackson-databind >= 3.0.0, < 3.1.5tools.jackson.core:jackson-databind >= 3.2.0, < 3.2.1Patched in:
com.fasterxml.jackson.core:jackson-databind 2.18.9com.fasterxml.jackson.core:jackson-databind 2.21.5com.fasterxml.jackson.core:jackson-databind 2.22.1tools.jackson.core:jackson-databind 3.1.5tools.jackson.core:jackson-databind 3.2.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91776High· 7.5TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID
CVE-2026-91777High· 7.5Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
CVE-2026-68497High· 7.5jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLD…
GHSA-mhm7-754m-9p8wMedium· 6.5jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`
CVE-2018-14721Critical· 10.0FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
CVE-2025-61916High· 7.9Spinnaker is an open source, multi-cloud continuous delivery platform