Medium
jackson-databind — security advisory
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
- Products
- jackson-databind
- Affected versions
- 2.10.0-2, 2.10.1-1, 2.10.2-1, 2.12.1-1, 2.12.5-1, 2.13.0-1, 2.13.0-2, 2.14.0+ds-1, 2.14.0+ds-1build1, 2.14.0+ds-2, 2.14.0-1, 2.2.2-1, 2.2.2-1ubuntu0.1~esm1, 2.4.2-2, 2.4.2-3, 2.4.2-3ubuntu0.1~esm1, 2.4.2-3ubuntu0.1~esm2, 2.8.6-1, 2.9.1-1, 2.9.4-1, 2.9.5-1, 2.9.8-1~18.04, 2.9.9.3-1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-54514
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:45 UTC · Revision 1
Source evidence
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
osv:UBUNTU-CVE-2026-54514
jackson-databind
Fixed versions: Not specified
jackson-databind
Fixed versions: Not specified
jackson-databind
Fixed versions: Not specified
jackson-databind
Fixed versions: Not specified
jackson-databind
Fixed versions: Not specified
jackson-databind
Fixed versions: Not specified
jackson-databind
Fixed versions: Not specified
jackson-databind
Fixed versions: Not specified
jackson-databind
Fixed versions: Not specified
Complete source record
{
"id": "f6d37142b26f80290633c29ceabcd9f6f739e01c149f253e20152f187594540a",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-54514",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-54514",
"summary": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.",
"evidence": "osv:UBUNTU-CVE-2026-54514",
"products": [
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.2.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.2.2-1ubuntu0.1~esm1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.4.2-2",
"evidence": "/affected/1/versions"
},
{
"value": "2.4.2-3",
"evidence": "/affected/1/versions"
},
{
"value": "2.4.2-3ubuntu0.1~esm1",
"evidence": "/affected/1/versions"
},
{
"value": "2.4.2-3ubuntu0.1~esm2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.8.6-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.9.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.9.4-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.9.5-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.9.8-1~18.04",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.9.9.3-1",
"evidence": "/affected/3/versions"
},
{
"value": "2.10.0-2",
"evidence": "/affected/3/versions"
},
{
"value": "2.10.1-1",
"evidence": "/affected/3/versions"
},
{
"value": "2.10.2-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.12.1-1",
"evidence": "/affected/4/versions"
},
{
"value": "2.12.5-1",
"evidence": "/affected/4/versions"
},
{
"value": "2.13.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "2.13.0-2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.0-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.0+ds-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.0+ds-1build1",
"evidence": "/affected/7/versions"
},
{
"value": "2.14.0+ds-2",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "jackson-databind",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.0+ds-1",
"evidence": "/affected/8/versions"
},
{
"value": "2.14.0+ds-1build1",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-54514",
"aliases": [
"UBUNTU-CVE-2026-54514"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/ubuntu/jackson-databind?arch=source&distro=esm-infra-legacy%2Ftrusty",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"2.2.2-1",
"2.2.2-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-databind-java",
"binary_version": "2.2.2-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/ubuntu/jackson-databind?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"2.4.2-2",
"2.4.2-3",
"2.4.2-3ubuntu0.1~esm1",
"2.4.2-3ubuntu0.1~esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-databind-java",
"binary_version": "2.4.2-3ubuntu0.1~esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/ubuntu/jackson-databind?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"2.8.6-1",
"2.9.1-1",
"2.9.4-1",
"2.9.5-1",
"2.9.8-1~18.04"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-databind-java",
"binary_version": "2.9.8-1~18.04"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/ubuntu/jackson-databind?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"2.9.9.3-1",
"2.10.0-2",
"2.10.1-1",
"2.10.2-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-databind-java",
"binary_version": "2.10.2-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/ubuntu/jackson-databind?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"2.12.1-1",
"2.12.5-1",
"2.13.0-1",
"2.13.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-databind-java",
"binary_version": "2.13.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/ubuntu/jackson-databind?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"2.14.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-databind-java",
"binary_version": "2.14.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/ubuntu/jackson-databind?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"2.14.0+ds-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-databind-java",
"binary_version": "2.14.0+ds-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/ubuntu/jackson-databind?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"2.14.0+ds-1build1",
"2.14.0+ds-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-databind-java",
"binary_version": "2.14.0+ds-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jackson-databind",
"purl": "pkg:deb/ubuntu/jackson-databind?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2.14.0+ds-1",
"2.14.0+ds-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54514.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjackson2-databind-java",
"binary_version": "2.14.0+ds-1build1"
}
]
}
}
],
"modified": "2026-10-17T12:59:05.770256705Z",
"provider": "osv",
"upstream": [
"CVE-2026-54514"
],
"references": [
"https://ubuntu.com/security/CVE-2026-54514",
"https://www.cve.org/CVERecord?id=CVE-2026-54514",
"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5",
"https://github.com/FasterXML/jackson-databind/pull/5951",
"https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4"
]
},
"related_cves": [
{
"value": "CVE-2026-54514",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 359282,
"published_at": "2026-06-23T21:17:00+00:00"
}