Server-side request forgery in FasterXML com.fasterxml.jackson.core:jackson-databind
Priority LOW 30CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 34 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.core:jackson-databind (FasterXML): 2.18.9, 2.21.5, 2.22.1tools.jackson.core:jackson-databind (FasterXML): 3.1.5, 3.2.1+2 more productsRed Hat: 34 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FasterXML | com.fasterxml.jackson.core:jackson-databind | 2.0.0 to before 2.18.9; 2.19.0 to before 2.21.5; 2.22.0 to before 2.22.1 | 2.18.9, 2.21.5, 2.22.1 | Patch available | CNA |
| FasterXML | tools.jackson.core:jackson-databind | 3.0.0 to before 3.1.5; 3.2.0 to before 3.2.1 | 3.1.5, 3.2.1 | Patch available | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.0.0 to before 2.18.9 | 2.18.9 | Patch available | GHSA-vvgp-rfg2-7rr6 |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.19.0 to before 2.21.5 | 2.21.5 | Patch available | GHSA-vvgp-rfg2-7rr6 |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.22.0 to before 2.22.1 | 2.22.1 | Patch available | GHSA-vvgp-rfg2-7rr6 |
| — | tools.jackson.core:jackson-databind (Maven) | 3.0.0 to before 3.1.5 | 3.1.5 | Patch available | GHSA-vvgp-rfg2-7rr6 |
| — | tools.jackson.core:jackson-databind (Maven) | 3.2.0 to before 3.2.1 | 3.2.1 | Patch available | GHSA-vvgp-rfg2-7rr6 |
- com.fasterxml.jackson.core:jackson-databind VendorFasterXML Affected 2.0.0 to before 2.18.9; 2.19.0 to before 2.21.5; 2.22.0 to before 2.22.1 Fixed in 2.18.9, 2.21.5, 2.22.1 Patch available CNA
- tools.jackson.core:jackson-databind VendorFasterXML Affected 3.0.0 to before 3.1.5; 3.2.0 to before 3.2.1 Fixed in 3.1.5, 3.2.1 Patch available CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.0.0 to before 2.18.9 Fixed in 2.18.9 Patch available GHSA-vvgp-rfg2-7rr6
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.19.0 to before 2.21.5 Fixed in 2.21.5 Patch available GHSA-vvgp-rfg2-7rr6
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.22.0 to before 2.22.1 Fixed in 2.22.1 Patch available GHSA-vvgp-rfg2-7rr6
- tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.0.0 to before 3.1.5 Fixed in 3.1.5 Patch available GHSA-vvgp-rfg2-7rr6
- tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.2.0 to before 3.2.1 Fixed in 3.2.1 Patch available GHSA-vvgp-rfg2-7rr6
Remediation
- Fix · CNA com.fasterxml.jackson.core:jackson-databind (FasterXML) Fixed in 2.18.9, 2.21.5, 2.22.1
- Fix · CNA tools.jackson.core:jackson-databind (FasterXML) Fixed in 3.1.5, 3.2.1
- Fix · GHSA-vvgp-rfg2-7rr6 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.18.9 Advisory →
- Fix · GHSA-vvgp-rfg2-7rr6 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.21.5 Advisory →
- Fix · GHSA-vvgp-rfg2-7rr6 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.22.1 Advisory →
- Fix · GHSA-vvgp-rfg2-7rr6 tools.jackson.core:jackson-databind (Maven) Fixed in 3.1.5 Advisory →
- Fix · GHSA-vvgp-rfg2-7rr6 tools.jackson.core:jackson-databind (Maven) Fixed in 3.2.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix planned: Out of support scope |
| OpenShift Developer Tools and Services | Affected | No fix planned: Out of support scope |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certificate System 10 | Affected | No fix planned: Out of support scope |
| Red Hat Certificate System 11 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Web Server 7 | Affected | No fix yet: Fix deferred |
| Red Hat Lightspeed for Runtimes Operator | Affected | No fix yet: Fix deferred |
| Red Hat Offline Knowledge Portal | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix planned: Out of support scope |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77310
- 2026-10-03 Alias added: GHSA-vvgp-rfg2-7rr6
References
Other 9
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6
- https://github.com/FasterXML/jackson-databind/pull/6058
- https://github.com/FasterXML/jackson-databind/commit/2fc7bd9057dd051d7dea0e5fcad89822d0fa5ebd
- https://github.com/FasterXML/jackson-databind
- https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.9
- https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.5
- https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.1
- https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.5
- https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.1
More FasterXML vulnerabilities
- TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
- TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
- TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
- TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
- TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
Sources
- CVE-2026-77310 · CVE Program
- CVE-2026-77310 · NVD
- FIRST EPSS
- GHSA-vvgp-rfg2-7rr6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-77310 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences