You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Unresolved IPv6 InetSocketAddress serialized without brackets, losing port on round-trip #6185
(reported by @renechoi in #6125 — fix to be implemented independently as the original PR was closed without a CLA)
InetSocketAddressSerializer writes values as host + ":" + port. For a resolved address it takes the host part from InetAddress.toString() and brackets IPv6 literals, so output looks like "[2001:db8::1]:443". For an unresolved address there is no InetAddress, so it falls back to getHostName() and writes an IPv6 literal bare:
InetSocketAddress.createUnresolved("2001:db8::1", 443)
// serialized as "2001:db8::1:443"
The trailing :443 is indistinguishable from another hextet, so the port cannot be recovered on deserialization.
This has become more visible since #5951: deserialization now always constructs unresolved addresses via InetSocketAddress.createUnresolved(), so a bare IPv6 address value read by Jackson no longer survives a round-trip — on re-serialization the port gets appended bare, and the next read absorbs it into the host name.
Expected: the unresolved branch should bracket IPv6 literals the same way the resolved branch already does, e.g. "[2001:db8::1]:443". Host names that are already bracketed (which is what the deserializer stores for "[...]:port" input) must not be bracketed twice.
Applies to 2.x (2.18+) and 3.x; existing JDKTypeSerializationTest.testInetSocketAddress() covers the unresolved form only for IPv4 and host names.
Activity
Fix #6185: bracket unresolved IPv6 host name in `InetSocketAddress` s…
Add release notes entry for #6185 in 2.21
Add release notes entry for #6185 in 2.22
Add release notes entry for FasterXML#6185 in 3.1
Add release notes entry for FasterXML#6185 in 3.2
[SPARK-59833] Upgrade Jackson to 2.22.3
CVE-2026-54514: do not resolve host names when deserializing InetSock…