CVE-2026-54514
MediumAdvisory
Published 23 Jun 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.004
- 30th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 871
- of 17,787 indexed, latest versions
- Container images
- 876
- deployed by those charts
- Fix available
- 1 of 1
- affected package
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
Carried by container images the latest versions of 871 of 17,787 indexed charts deploy, on 876 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jackson-databindmaven | 2.0.5, 2.2.3, 2.3.0, 2.3.3+105 more | 2.18.8, 2.21.4, 3.1.4 | 876 |
- OSV records
- GHSA-hgj6-7826-r7m5
Charts affected
871 by stars
Container images carrying it
876 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| vlebediantsev/ | e7f20450d2ae | jackson-databind | 2.18.8 | 1 |
| vlebediantsev/ | 10393a89b4a8 | jackson-databind | 2.18.8 | 1 |
| vlebediantsev/ | df8bf38c535b | jackson-databind | 2.18.8 | 1 |
| vlebediantsev/ | 427af418b75e | jackson-databind | 2.18.8 | 1 |
| vlebediantsev/ | 9319437f3c8f | jackson-databind | 2.18.8 | 1 |
| voltha/ | e038acb950d3 | jackson-databind | 2.18.8 | 1 |
| vrijbrp/ | 5c770c2ae48c | jackson-databind | 2.18.8 | 1 |
| wavefronthq/ | d1064d28f6eb | jackson-databind | 2.18.8 | 1 |
| wazuh/ | 9c344d2b1757 | jackson-databind | 2.18.8 | 1 |
| wazuh/ | a7a2076b167e | jackson-databind | 2.18.8 | 1 |
| wazuh/ | b149b30da686 | jackson-databind | 2.18.8 | 1 |
| wistefan/ | e0887302b2d8 | jackson-databind | 2.18.8 | 1 |
| woojoong/ | ec230db19652 | jackson-databind | 2.18.8 | 1 |
| xeotek/ | 39a3b37a17c5 | jackson-databind | 2.18.8 | 1 |
| xeotek/ | 4c6b04d9ce55 | jackson-databind | 2.18.8 | 1 |
| xetusoss/ | 88f25242b9ee | jackson-databind | 2.18.8 | 1 |
| xuxueli/ | 640093c35fd6 | jackson-databind | 2.18.8 | 1 |
| yuzutech/ | 192b7b27c857 | jackson-databind | 2.18.8 | 1 |
| zahoriaut/ | 351f8a220ed7 | jackson-databind | 2.18.8 | 1 |
| zahoriaut/ | b2de13916f3e | jackson-databind | 2.18.8 | 1 |
| zammad/ | 8274d75a51fc | jackson-databind | 2.18.8 | 1 |
| zbalogh/ | 7c247e399a1f | jackson-databind | 2.18.8 | 1 |
| zenko/ | 386a1f48ec0e | jackson-databind | 2.18.8 | 1 |
| gcr.io/ | 0ee5f968d2ab | jackson-databind | 2.18.8 | 1 |
| gcr.io/ | ae57b62291aa | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | e9c2ce635b89 | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | 4a2824296412 | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | d9d796a1b846 | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | 503c00321502 | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | f3d0c7d35498 | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | aa45adaf59a7 | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | 30d1a445acc7 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | e310642de2e2 | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | 90a34412c6b5 | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | acb8dbce38fd | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | c144bdd688d7 | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | ac62269785ac | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | 8f4345c77dda | jackson-databind | 3.1.4 | 1 |
| ghcr.io/ | cf85570b1324 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 3be878690629 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | f1629ac5f9ec | jackson-databind | 3.1.4 | 1 |
| ghcr.io/ | 415323ef112b | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 05002092c621 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 6fe372e4e481 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | c4c52955814f | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | a7d0cc9e260a | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 10006bc0f309 | jackson-databind | 2.18.8 | 1 |
| ghcr.io/ | fd93e0d125b3 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 5de339b3d537 | jackson-databind | 2.21.4 | 1 |
| ghcr.io/ | 10de22c8cbce | jackson-databind | 2.18.8 | 1 |