CVE-2026-54514

Katalog CVE

CVSS 5.3 · Medium EPSS 0,37%

Kerentanan Server-Side Request Forgery (SSRF) pada fasterxml jackson-databind. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

27 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5 advisory vendor
• https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4 patch
• https://github.com/FasterXML/jackson-databind/pull/5951 issue tracking · patch