CVE-2026-54514

A flaw was found in jackson-databind, a library used for processing JSON data. This vulnerability allows a remote attacker to force the application to perform an attacker-chosen DNS (Domain Name System) query. This occurs when untrusted JSON input containing specific network address information is processed, potentially leading to the disclosure of sensitive network configuration details.

Moderate: A flaw in jackson-databind can lead to information disclosure in Red Hat products that process untrusted JSON input. By crafting malicious JSON containing InetSocketAddress fields, a remote attacker can force the application to perform arbitrary DNS queries. This eager DNS resolution occurs before application-level validation, potentially revealing internal network configuration details through DNS logs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.