CVE-2026-77310 FasterXML CVE debrief

Who should care

Defenders and security teams responsible for jackson-databind library usage should assess exposure and prioritize patching or mitigation to prevent potential DNS-based server-side request forgery and internal-host enumeration attacks. They should review and update security configurations to prevent internal-host enumeration and implement network monitoring to detect potential DNS-based attacks.

Why it matters

CVE-2026-77310 is a vulnerability in jackson-databind that allows for DNS-based server-side request forgery and internal-host enumeration. Defenders should prioritize patching or mitigating this vulnerability to prevent potential attacks. The issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

• Potential DNS-based server-side request forgery attacks
• Internal-host enumeration via DNS resolution
• Verification of affected versions and patching priority
• Monitoring for potential DNS-based attacks

Technical summary

The java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization. This allows for DNS-based server-side request forgery and internal-host enumeration. The issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1. Defenders should assess exposure and prioritize patching or mitigation to prevent potential attacks. The vulnerability is caused by the deserialization process, which can lead to DNS-based attacks.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential DNS-based server-side request forgery and internal-host enumeration attacks.

Recommended defensive actions

• Patch or upgrade to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1 of jackson-databind
• Implement network monitoring to detect potential DNS-based attacks
• Review and update security configurations to prevent internal-host enumeration
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and fixed versions. The vulnerability allows for DNS-based server-side request forgery and internal-host enumeration. Defenders should verify affected versions and prioritize patching or mitigation. The issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1. Evidence is limited to public CVE and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.