google/gson · error · JsonSyntaxException

Failed parsing '" + s + "' as InetAddress; at path " + in.ge

Error message

Failed parsing '" + s + "' as InetAddress; at path " + in.getPreviousPath() + "; to allow DNS addresses, set system property gson.allowDnsInetAddress to \"true\""

What it means

Gson's InetAddress adapter rejects any string that does not look like an IP address (the regex '.*:.*|[0-9]+(\.[0-9]+){3}') unless the system property gson.allowDnsInetAddress is set to "true". This is a deliberate security measure to prevent deserialization from triggering DNS lookups against attacker-controlled hostnames. Non-IP strings therefore throw JsonSyntaxException.

Source

Thrown at gson/src/main/java/com/google/gson/internal/bind/TypeAdapters.java:758

  public static final TypeAdapter<InetAddress> INET_ADDRESS =
      new TypeAdapter<InetAddress>() {

        // A pattern that matches every IP address and no DNS address. It matches plenty of things
        // that aren't either of those, which is fine. An IPv4 address is n.n.n.n where each n is a
        // non-negative integer. An IPv6 address contains at least one colon. (There are further
        // constraints in both cases, but they don't matter here.)
        private final Pattern ipAddressPattern = Pattern.compile(".*:.*|[0-9]+(\\.[0-9]+){3}");

        @Override
        public InetAddress read(JsonReader in) throws IOException {
          if (in.peek() == JsonToken.NULL) {
            in.nextNull();
            return null;
          }
          String s = in.nextString();
          if (!ipAddressPattern.matcher(s).matches()
              && !Boolean.getBoolean("gson.allowDnsInetAddress")) {
            throw new JsonSyntaxException(
                "Failed parsing '"
                    + s
                    + "' as InetAddress; at path "
                    + in.getPreviousPath()
                    + "; to allow DNS addresses, set system property gson.allowDnsInetAddress to"
                    + " \"true\"");
          }
          @SuppressWarnings("AddressSelection")
          InetAddress addr = InetAddress.getByName(s);
          return addr;
        }

        @Override
        public void write(JsonWriter out, InetAddress value) throws IOException {
          out.value(value == null ? null : value.getHostAddress());
        }
      };

View on GitHub (pinned to 8b8628c656)

Solutions

If DNS resolution during deserialization is acceptable in your trust model, set -Dgson.allowDnsInetAddress=true on the JVM.
Prefer storing/resolving IP literals in the JSON data so no DNS lookup is needed.
Register a custom TypeAdapter<InetAddress> that resolves hostnames explicitly under your control.
Deserialize the value as String and call InetAddress.getByName yourself in application code with input validation.

Example fix

// before
InetAddress addr = gson.fromJson("\"my-host\"", InetAddress.class);

// after (only if you accept the DNS-lookup risk)
System.setProperty("gson.allowDnsInetAddress", "true");
InetAddress addr = gson.fromJson("\"my-host\"", InetAddress.class);

Defensive patterns

Strategy: validation

Validate before calling

boolean isParsableInetAddress(String s) {
  if (s == null || s.isEmpty()) return false;
  if (s.contains(":") || s.matches("[0-9]+(\\.[0-9]+){3}")) return true;
  return Boolean.getBoolean("gson.allowDnsInetAddress");
}

Type guard

static boolean isIpLiteral(String s) {
  return s != null && (s.contains(":") || s.matches("[0-9]+(\\.[0-9]+){3}"));
}

Try / catch

try {
  InetAddress a = gson.fromJson(json, InetAddress.class);
} catch (JsonSyntaxException e) {
  // if DNS is expected/trusted, set gson.allowDnsInetAddress and retry; otherwise reject input
}

Prevention

Prefer storing IP literals in serialized data.
Only enable gson.allowDnsInetAddress when input is from a trusted source, to avoid SSRF via deserialization.
Resolve hostnames in application code with explicit validation rather than at deserialization time.

When it happens

Trigger: Deserializing a JSON string such as "example.com" or "localhost" into an InetAddress field while gson.allowDnsInetAddress is not enabled.

Common situations: Service configs that store hostnames rather than IPs, containerized environments where the field legitimately holds a DNS name, or migrating from an older Gson that allowed hostnames freely.

Related errors

AI-assisted analysis of google/gson@8b8628c656 (2026-08-04). Data as JSON: /data/errors/4ef49ba566fead51.json. Report an issue: GitHub.