Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Jackson-databind 2.13.4 may cause unwanted network calls

published 28 days ago
Summary

The Jackson-databind library version 2.13.4 can turn certain data into a network address, causing the system to look up DNS names automatically. This can be abused to make the application contact internal or external services without permission. Update to the Red Hat provided 2.13.4.rhlw-00027 version to stop the automatic lookups.

What to do
  • Update redhat com.fasterxml.jackson.core:jackson-databind to version 2.13.4.rhlw-00027.
Affected software
Ecosystem VendorProductAffected versions
Red Hat Lightwell:Maven redhat com.fasterxml.jackson.core:jackson-databind < 2.13.4.rhlw-00027
Fix: upgrade to 2.13.4.rhlw-00027
Original advisory text
Lightwell Security Advisory: jackson-databind 2.13.4.rhlw-00027
Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.13.4.rhlw-00027 with a backported security fix.

CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.13.4 from Maven Central.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Timeline
Published8 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
RHLW-2026-f50c19633c98b180 · OSV
Track software like this
Free during beta