Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-06-23T20:51:50
jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-502
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
A flaw was found in jackson-databind, a library used for processing JSON data. This vulnerability allows a remote attacker to force the application to perform an attacker-chosen DNS (Domain Name System) query. This occurs when untrusted JSON input containing specific network address information is processed, potentially leading to the disclosure of sensitive network configuration details.
Moderate: A flaw in `jackson-databind` can lead to information disclosure in Red Hat products that process untrusted JSON input. By crafting malicious JSON containing `InetSocketAddress` fields, a remote attacker can force the application to perform arbitrary DNS queries. This eager DNS resolution occurs before application-level validation, potentially revealing internal network configuration details through DNS logs.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Cryostat 4
Fix deferred
jackson-databind
OpenShift Developer Tools and Services
Fix deferred
jenkins
OpenShift Developer Tools and Services
Fix deferred
jenkins-2-plugins
OpenShift Developer Tools and Services
Fix deferred
ocp-tools-4/jenkins-rhel8
OpenShift Developer Tools and Services
Fix deferred
ocp-tools-4/jenkins-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-ekb-dispatcher-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-ekb-receiver-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-gaudi-rhel9
Red Hat AMQ Broker 7
Fix deferred
jackson-databind
Red Hat AMQ Clients
Fix deferred
jackson-databind
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/de-minimal-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/de-supported-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
python3.11-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python3.12-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python3x-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python-drools-jpy-jar
Red Hat build of Apache Camel 4 for Quarkus 3
Not affected
jackson-databind
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
jackson-databind
Red Hat build of Apache Camel - HawtIO 4
Fix deferred
jackson-databind
Red Hat build of Apicurio Registry 3
Fix deferred
jackson-databind
Red Hat build of Debezium 3
Fix deferred
jackson-databind
Red Hat Build of Keycloak
Fix deferred
jackson-databind
Red Hat Build of Keycloak
Fix deferred
rhbk/keycloak-rhel9
Red Hat Build of Keycloak
Fix deferred
rhbk/keycloak-rhel9-operator
Red Hat Build of Keycloak
Fix deferred
rhbk-openshift-rhel9/rhbk-openshift-rhel9
Red Hat Build of Keycloak
Fix deferred
rhbk-rhel9-operator/rhbk-rhel9-operator
Red Hat build of Quarkus
Affected
jackson-databind
Red Hat Certificate System 10
Fix deferred
redhat-pki:10/redhat-pki
Red Hat Data Grid 8
Fix deferred
jackson-databind
Red Hat Enterprise Linux 10
Fix deferred
dogtag-pki
Red Hat Enterprise Linux 8
Fix deferred
pki-deps:10.6/jackson-databind
Red Hat Enterprise Linux 9
Fix deferred
jackson-databind
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gaudi-rhel9
Red Hat Fuse 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 8
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform Expansion Pack
Fix deferred
jackson-databind
Red Hat Lightspeed for Runtimes Operator
Fix deferred
rh-lightspeed-runtimes/runtimes-agent-init-rhel9
Red Hat Offline Knowledge Portal
Fix deferred
offline-knowledge-portal/rhokp-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-modelmesh-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-spark-operator-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-trustyai-service-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/multicluster-redirector-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/openvsx-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/pluginregistry-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/server-rhel9
Red Hat Satellite 6
Fix deferred
candlepin
Red Hat Satellite 6
Fix deferred
openvox-server
Red Hat Satellite 6
Fix deferred
puppetserver
Red Hat Satellite 6
Fix deferred
satellite:el8/candlepin
Red Hat Satellite 6
Fix deferred
satellite:el8/puppetserver
Red Hat Single Sign-On 7
Fix deferred
jackson-databind
streams for Apache Kafka 2
Fix deferred
jackson-databind
streams for Apache Kafka 3
Fix deferred
jackson-databind
https://www.cve.org/CVERecord?id=CVE-2026-54514
https://nvd.nist.gov/vuln/detail/CVE-2026-54514
https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4
https://github.com/FasterXML/jackson-databind/pull/5951
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5