https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:51:55.229935+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0914 certfr-2026-avi-0914 — De multiples vulnérabilités ont été découvertes dans Oracle Database Server. Elles permettent à un attaquant de provoqu… 2026-10-02T23:51:55.279722+00:00 certfr-2026-avi-0914 https://cve.radiocsirt.org/vuln/cleanstart-2026-am39668 Withdrawn: CLEANSTART-2026-AM39668 — yawkat LZ4 Java provides LZ4 compression for Java 2026-10-02T23:51:55.279764+00:00

Withdrawn by the publisher.

Affected: CleanStart: apache-nifi

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-330169 EUVD-2026-330169 2026-10-02T23:51:55.279795+00:00 EUVD-2026-330169 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54514 fkie_cve-2026-54514 2026-10-02T23:51:55.279816+00:00

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

 https://cve.radiocsirt.org/vuln/ghsa-hgj6-7826-r7m5 GHSA-hgj6-7826-r7m5 — jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF) 2026-10-02T23:51:55.279841+00:00

Affected: Maven: com.fasterxml.jackson.core:jackson-databind, Maven: tools.jackson.core:jackson-databind

## Summary `JDKFromStringDeserializer` constructed `InetSocketAddress` with `new InetSocketAddress(host, port)`, which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an `InetSocketAddress` field issues an attacker-chosen DNS query during `readValue`, before any application-level validation or connect logic. The fix uses `InetSocketAddress.createUnresolved(host, port)`, deferring DNS to an explicit connect.

## Impact An attacker controlling JSON deserialized into an `InetSocketAddress`-bearing type can force outbound DNS lookups for attacker-chosen hostnames at deserialization time (SSRF / DNS-based out-of-band interaction / internal-resolver probing), purely from binding.

## Affected / Patched (verified via `git tag --contains` on `1f5a103`) - 2.18 line: `>= 2.18.0, < 2.18.8` -> fixed in **2.18.8** - 2.19-2.21 line: `>= 2.19.0, < 2.21.4` -> fixed in **2.21.4** - 3.x line: `>= 3.0.0, < 3.1.4` -> fixed in **3.1.4**

## Severity / CWE Maintainer: minor. Reporter: LOW. CWE-918 (SSRF).

## Upstream fix FasterXML/jackson-databind#5951 ("Improve InetSocketAddress deserialization"). Released 2026-06-04 in 2.18.8 / 2.21.4 / 3.1.4.

## Credits Omkhar Arasaratnam (@omkhar) - finder.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11118-1 openSUSE-SU-2026:11118-1 — jackson-databind-2.18.8-1.1 on GA media 2026-10-02T23:51:55.279880+00:00

jackson-databind-2.18.8-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2026:22504-1 SUSE-SU-2026:22504-1 — Security update for jackson-annotations, jackson-core, jackson-databind 2026-10-02T23:51:55.279898+00:00

Security update for jackson-annotations, jackson-core, jackson-databind

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54514 UBUNTU-CVE-2026-54514 2026-10-02T23:51:55.279914+00:00

Affected: Ubuntu:Pro:14.04:LTS: jackson-databind, Ubuntu:Pro:16.04:LTS: jackson-databind, Ubuntu:18.04:LTS: jackson-databind, Ubuntu:20.04:LTS: jackson-databind, Ubuntu:22.04:LTS: jackson-databind, Ubuntu:24.04:LTS: jackson-databind, Ubuntu:25.10: jackson-databind, Ubuntu:26.04:LTS: jackson-databind

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2058 WID-SEC-W-2026-2058 — FasterXML Jackson: Mehrere Schwachstellen 2026-10-02T23:51:55.279946+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FasterXML Jackson ausnutzen, um Schutzmechanismen und Autorisierungsregeln zu umgehen, Daten zu manipulieren, Informationen offenzulegen oder einen Denial-of-Service zu verursachen.