CVE-2026-77310
Received Received - Intake

SSRF via DNS Resolution in Jackson Databind

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: GitHub, Inc.

Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-25
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-77310
EUVD
EUVD-2026-65088

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fasterxml jackson-databind to 3.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77310 is a Server-Side Request Forgery (SSRF) vulnerability in the jackson-databind library. It occurs during deserialization when the code processes attacker-controlled input for java.net.InetAddress. The vulnerability allows an attacker to force outbound DNS lookups for arbitrary hostnames before any validation, enabling DNS-based SSRF or internal-host enumeration.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected DNS lookups originating from applications using jackson-databind. Check logs for deserialization operations involving java.net.InetAddress. Use tools like Wireshark or tcpdump to capture outbound DNS requests to unrecognized or attacker-controlled domains.

Impact Analysis

This vulnerability could allow an attacker to perform DNS-based SSRF attacks, which may lead to unauthorized access to internal systems or exfiltration of data. It could also enable enumeration of internal hosts by forcing DNS lookups to specific targets.

Compliance Impact

This vulnerability may violate compliance requirements by exposing sensitive data or internal systems to unauthorized access. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A successful SSRF attack could lead to data breaches, resulting in non-compliance with these regulations.

Mitigation Strategies

Immediately upgrade jackson-databind to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1 or later. If upgrading is not possible, restrict deserialization of java.net.InetAddress inputs or implement strict input validation to prevent attacker-controlled DNS lookups.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart