{"vulnerability": "CVE-2026-77310", "sightings": [{"uuid": "588b6253-c212-4d3d-963c-66f416bf2be0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77310", "type": "seen", "source": "https://gist.github.com/alon710/d15bea3a753ad5f44e3b7643aac9a27e", "content": "# CVE-2026-77310: CVE-2026-77310: Server-Side Request Forgery via DNS Resolution in jackson-databind\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77310\n\n## Summary\nA Server-Side Request Forgery (SSRF) vulnerability exists in FasterXML jackson-databind before versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1. The flaw occurs during the deserialization of java.net.InetAddress fields, where the library implicitly triggers eager DNS lookups. Unauthenticated remote attackers can exploit this behavior by passing arbitrary hostnames in JSON fields, forcing target servers to make outbound DNS lookup requests.\n\n## TL;DR\nJackson Databind's deserializer for java.net.InetAddress executes synchronous, blocking DNS resolution when processing hostnames, enabling remote, unauthenticated attackers to trigger outbound Server-Side Request Forgery (SSRF) via crafted JSON payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918 (Server-Side Request Forgery)\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n- **Impact Category**: Low Confidentiality (SSRF via DNS)\n\n## Affected Systems\n\n- Applications utilizing FasterXML jackson-databind to deserialize untrusted JSON into models containing java.net.InetAddress properties.\n- **jackson-databind (com.fasterxml.jackson.core)**: >= 2.0.0, < 2.18.9 (Fixed in: `2.18.9`)\n- **jackson-databind (com.fasterxml.jackson.core)**: >= 2.19.0, < 2.21.5 (Fixed in: `2.21.5`)\n- **jackson-databind (com.fasterxml.jackson.core)**: >= 2.22.0, < 2.22.1 (Fixed in: `2.22.1`)\n- **jackson-databind (tools.jackson.core)**: >= 3.0.0, < 3.1.5 (Fixed in: `3.1.5`)\n- **jackson-databind (tools.jackson.core)**: >= 3.2.0, < 3.2.1 (Fixed in: `3.2.1`)\n\n## Mitigation\n\n- Upgrade jackson-databind to a patched release line.\n- Implement network egress filtering to restrict unauthorized outbound DNS requests.\n- Configure a custom deserializer to sanitize java.net.InetAddress inputs manually.\n\n**Remediation Steps:**\n1. Identify all projects pulling com.fasterxml.jackson.core:jackson-databind or tools.jackson.core:jackson-databind.\n2. Update the project configuration (Maven pom.xml or Gradle build files) to force the patched versions.\n3. Rebuild the application and verify that passing hostnames to InetAddress fields yields a 400 Bad Request or parsing exception.\n\n## References\n\n- [FasterXML Jackson Databind Security Advisory GHSA-vvgp-rfg2-7rr6](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6)\n- [NVD Vulnerability Record](https://nvd.nist.gov/vuln/detail/CVE-2026-77310)\n- [GitHub Pull Request #6058](https://github.com/FasterXML/jackson-databind/pull/6058)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77310) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T10:30:32.000000Z"}]}