CVE-2026-54514: Jackson-databind DNS Leakage via InetSocketAddress Deserialization

Technical summary

The vulnerability exists in JDKFromStringDeserializer, which constructs InetSocketAddress objects using the eager constructor new InetSocketAddress(host, port). This constructor resolves the hostname to an IP address at deserialization time, not at connection time. An attacker can craft JSON with a malicious hostname field that forces a DNS query during Jackson's readValue() call, before any downstream application validation occurs. The fix migrates to InetSocketAddress.createUnresolved(host, port), deferring DNS resolution until an explicit connect operation is initiated by the application. This eliminates the forced DNS query during deserialization and puts hostname validation and connection logic back under application control.

Business impact

Organizations using Jackson-databind to deserialize untrusted JSON are exposed to information disclosure and potential DNS-based side-channel attacks. Attackers can infer which hostnames are being processed and mount DNS exfiltration attacks or DNS rebinding attacks if your application later connects to the resolved address. In multi-tenant or sensitive environments, DNS query logs could reveal patterns about which clients or payloads are being processed. The attack requires no special privileges and can be triggered remotely by sending crafted JSON payloads.

Affected systems

Jackson-databind versions 2.0.0 through 2.18.7, 2.21.0 through 2.21.3, and 3.0.0 through 3.1.3 are affected. The vulnerability only manifests when an application deserializes untrusted JSON into a type containing an InetSocketAddress field. Any Java application using Jackson-databind for REST APIs, message processing, or configuration parsing is potentially at risk if it accepts JSON with InetSocketAddress fields from untrusted sources.

Exploitability

Exploitability is straightforward: an attacker simply sends JSON with a crafted hostname in an InetSocketAddress field to a vulnerable application endpoint. No authentication, special network position, or user interaction is required. The attack is entirely passive from the attacker's perspective—they observe DNS queries or exfiltrate data through DNS side-channels. The CVSS score of 5.3 reflects the low barrier to exploitation and the modest but meaningful information disclosure risk, balanced against the lack of direct confidentiality breach or system compromise.

Remediation

Update jackson-databind to version 2.18.8, 2.21.4, 3.1.4, or later. These versions replace eager DNS resolution with deferred resolution, ensuring DNS lookups occur only when the application explicitly connects. After upgrading, conduct a code review to identify all code paths that deserialize JSON into types containing InetSocketAddress fields, and verify that hostname validation logic is in place before any network connection attempts.

Patch guidance

Apply the following patches based on your current version line: (1) If on 2.x, update to 2.18.8 or later. (2) If on 2.21.x, update to 2.21.4 or later. (3) If on 3.x, update to 3.1.4 or later. Verify the patched version is present in your dependency tree using mvn dependency:tree or gradle dependencies, as transitive dependencies may pull in older versions. Test deserialization of sample JSON payloads in your integration test suite after patching to ensure no regressions.

Detection guidance

Monitor Jackson-databind versions in use via Software Bill of Materials (SBOM) scanning and dependency checkers. At runtime, enable debug logging on Jackson deserialization to observe hostname inputs before they are resolved; look for unexpected or attacker-controlled hostnames. In network logs, search for unusual DNS queries that correlate with JSON ingestion events, particularly queries to domains not in your normal DNS allowlist. On affected versions, network-level DNS monitoring can reveal exploitation attempts, though the fix ultimately requires a code update.

Why prioritize this

This vulnerability merits prompt but measured action. The attack surface is limited to applications that deserialize InetSocketAddress fields from untrusted JSON, and the impact is primarily information disclosure rather than code execution or availability loss. However, the simplicity of exploitation and the pervasive use of Jackson-databind in Java microservices mean that affected applications could number in the hundreds or thousands across many organizations. Prioritize patching any service that exposes JSON endpoints and uses Jackson-databind, particularly those handling sensitive or regulated data where DNS query patterns could be sensitive.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects: (1) Network-adjacent attack vector requiring no authentication, (2) Low attack complexity with no special network position required, (3) Low confidentiality impact (DNS leakage and potential side-channel inference), (4) No integrity or availability impact, and (5) Unchanged scope (no privilege escalation). The score appropriately penalizes the ease of exploitation but recognizes that direct system compromise or severe data exfiltration is not possible via this mechanism alone. Organizations in regulated industries or with strict DNS policy controls may score this higher due to compliance implications.

Frequently asked questions