jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization

[ Description ]Official description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

[ Fixes ]Fixes and patches

• com.fasterxml.jackson.core:jackson-databind 2.18.9Fixed version · GitHub Advisories · maven package com.fasterxml.jackson.core:jackson-databind: upgrade to 2.18.9 or later (affected >= 2.0.0, < 2.18.9)
• com.fasterxml.jackson.core:jackson-databind 2.21.5Fixed version · GitHub Advisories · maven package com.fasterxml.jackson.core:jackson-databind: upgrade to 2.21.5 or later (affected >= 2.19.0, < 2.21.5)
• com.fasterxml.jackson.core:jackson-databind 2.22.1Fixed version · GitHub Advisories · maven package com.fasterxml.jackson.core:jackson-databind: upgrade to 2.22.1 or later (affected >= 2.22.0, < 2.22.1)
• tools.jackson.core:jackson-databind 3.1.5Fixed version · GitHub Advisories · maven package tools.jackson.core:jackson-databind: upgrade to 3.1.5 or later (affected >= 3.0.0, < 3.1.5)
• tools.jackson.core:jackson-databind 3.2.1Fixed version · GitHub Advisories · maven package tools.jackson.core:jackson-databind: upgrade to 3.2.1 or later (affected >= 3.2.0, < 3.2.1)

[ Advisories ]Government CERT advisories

• CERT-FR16 Oct 2026CERTFR-2026-AVI-1336

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-14671CVE-2026-11548CVE-2022-22950+490 more CVEs
• CERT-FR9 Oct 2026CERTFR-2026-AVI-1291

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-49978CVE-2025-27895CVE-2026-59651+195 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1249

  Multiple vulnerabilities in VMware products Translated from French

  Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

  CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1256

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-27980CVE-2026-58055CVE-2026-49978+360 more CVEs
• BSI CERT-Bund27 Sep 2026WID-SEC-2026-3595

  IBM QRadar SIEM: Multiple vulnerabilities Translated from German

  CVE-2025-54518CVE-2026-44186CVE-2026-59878+151 more CVEs

[ Packages ]Affected open-source packages

• com.fasterxml.jackson.core:jackson-databind mavenAffected >= 2.0.0, < 2.18.9 · fixed in 2.18.9 · GHSA-vvgp-rfg2-7rr6
• com.fasterxml.jackson.core:jackson-databind mavenAffected >= 2.19.0, < 2.21.5 · fixed in 2.21.5 · GHSA-vvgp-rfg2-7rr6
• com.fasterxml.jackson.core:jackson-databind mavenAffected >= 2.22.0, < 2.22.1 · fixed in 2.22.1 · GHSA-vvgp-rfg2-7rr6
• tools.jackson.core:jackson-databind mavenAffected >= 3.0.0, < 3.1.5 · fixed in 3.1.5 · GHSA-vvgp-rfg2-7rr6
• tools.jackson.core:jackson-databind mavenAffected >= 3.2.0, < 3.2.1 · fixed in 3.2.1 · GHSA-vvgp-rfg2-7rr6

[ References ]References

• github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6x_refsource_CONFIRM