Bug 2523089 (CVE-2026-77310)

Summary:	CVE-2026-77310 com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aakkiang, alinfoot, amctagga, anthomas, ant, anujha, aoconnor, aschwart, asoldano, asyoung, aszczucz, ataylor, avibelli, bbaranow, bbrownin, bgeorges, bmaxwell, bniver, boliveir, bstansbe, ccranfor, cescoffi, cfu, cmah, csutherl, dandread, dbruscin, dfreiber, dhanak, dkreling, dlofthou, drichtar, drosa, drow, dschmidt, dsimansk, dsoumis, dtrifiro, ebaron, edewata, ehelms, ehugonne, ewittman, flucifre, fmariani, fmongiar, gbenhaim, ggainey, gkimetto, gmalinko, gmeno, groman, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jburrell, jbuscemi, jclere, jhollowa, jlanda, jmagne, jmartisk, jnethert, jpasqual, jpechane, juwatts, jwon, kaycoth, kingland, kshier, kvanderr, lthon, manderse, mbenjamin, mcarlett, mdellweg, mfargett, mhackett, mhulan, mnovotny, mosmerov, mposolda, msvehla, nipatil, niyer, nmoumoul, nwallace, olubyans, osousa, pantinor, pberan, pcreech, pdelbell, pesilva, pgallagh, pjindal, plodge, pmackay, prichard, prisingh, probinso, rbryant, rchan, rguimara, rhel-process-autobot, rkubis, rmartinc, rmaucher, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, sdawley, simaishi, skhandel, smallamp, snegrini, sostapov, ssilvert, stcannon, sthirugn, sthorger, szappis, taherrin, tcunning, teagle, thjenkin, tmalecek, tqvarnst, twaugh, vdosoudi, vereddy, vkumar, vmuzikar, watson-tool-maintainers, weaton, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability by providing specially crafted input during data deserialization, specifically when `java.net.InetAddress` objects are processed. This causes the application to perform eager DNS resolution on attacker-controlled hostnames, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows for out-of-band data exfiltration or the enumeration of internal network hosts.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-24 19:41:27 UTC

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.