CVE-2026-77310

A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability by providing specially crafted input during data deserialization, specifically when java.net.InetAddress objects are processed. This causes the application to perform eager DNS resolution on attacker-controlled hostnames, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows for out-of-band data exfiltration or the enumeration of internal network hosts.

Moderate impact. Red Hat products utilizing jackson-databind are susceptible to server-side request forgery (SSRF) and internal host enumeration. This occurs when attacker-controlled input, containing hostnames or IP addresses, is deserialized, leading to eager DNS resolution and potential information disclosure or internal network probing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.