CVE-2026-77310: CWE-918: Server-Side Request Forgery (SSRF) in FasterXML com.fasterxml.jackson.core:jackson-databind

This vulnerability arises because jackson-databind's FromStringDeserializer deserializes java.net.InetAddress by calling InetAddress.getByName(value), which triggers an immediate DNS resolution on attacker-controlled input. Although a related vulnerability in InetSocketAddress deserialization was fixed by switching to createUnresolved to avoid DNS lookups, the InetAddress branch remains unpatched and still performs eager DNS resolution. This allows an attacker who controls JSON input deserialized into an InetAddress target to induce DNS lookups during deserialization, enabling DNS-based SSRF and blind internal host enumeration. The vulnerability affects multiple jackson-databind versions prior to 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1. No direct patch for this InetAddress issue is currently available, and the suggested fix is to defer or validate resolution similarly to the InetSocketAddress fix.

An attacker able to influence JSON deserialized into an InetAddress target can cause the application to perform outbound DNS lookups for attacker-chosen hostnames during deserialization, before any application-level validation. This enables DNS-based SSRF, which can be used for out-of-band data exfiltration or blind probing of internal hostnames. The vulnerability does not allow arbitrary socket connections or remote code execution but exposes a DNS lookup primitive that can leak information about internal network topology or trigger DNS callbacks.

No official fix for the InetAddress deserialization issue is currently available. The previously released fix for InetSocketAddress deserialization does not cover InetAddress. Users should monitor the vendor advisory for updates. As a practical mitigation, avoid deserializing untrusted input into InetAddress types or implement validation to prevent attacker-controlled hostnames from triggering DNS resolution. Deferring DNS resolution or providing an opt-in/out mechanism similar to the InetSocketAddress fix is recommended once available.