Vulnerability-Lookup

CVE-2026-19032 (GCVE-0-2026-19032)

Vulnerability from cvelistv5 – Published: 2026-09-01 03:18 – Updated: 2026-09-01 13:13

Title

jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

Summary

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 13:12 UTC

CWE

CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

Assigner

HeroDevs mitre root

References

5 references

URL	Tags
https://github.com/FasterXML/jackson-databind/sec…	third-party-advisory
https://github.com/FasterXML/jackson-databind/pull/6129	patchissue-tracking
https://github.com/FasterXML/jackson-databind/com…	patch
https://github.com/FasterXML/jackson-databind/com…	patch
https://github.com/FasterXML/jackson-databind/com…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
FasterXML	jackson-databind	Affected: 2.8.0 , < 2.18.10 (maven) Affected: 2.19.0 , < 2.21.6 (maven) Affected: 2.22.0 , < 2.22.2 (maven)	guessed
FasterXML	jackson-databind	Affected: 3.0.0 , < 3.1.6 (maven) Affected: 3.2.0 , < 3.2.2 (maven)	guessed

Date Public

2026-07-29 08:05

Credits

waydeshi pjfanning

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19032",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T13:12:52.665042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T13:13:09.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.fasterxml.jackson.core:jackson-databind",
          "product": "jackson-databind",
          "programFiles": [
            "src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java"
          ],
          "programRoutines": [
            {
              "name": "com.fasterxml.jackson.databind.ext.NioPathDeserializer.deserialize"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-databind",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "2.18.10",
              "status": "affected",
              "version": "2.8.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.21.6",
              "status": "affected",
              "version": "2.19.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.22.2",
              "status": "affected",
              "version": "2.22.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "tools.jackson.core:jackson-databind",
          "product": "jackson-databind",
          "programFiles": [
            "src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java"
          ],
          "programRoutines": [
            {
              "name": "tools.jackson.databind.deser.jdk.JDKFromStringDeserializer.NioPathHelper.deserialize"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-databind",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "3.1.6",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "3.2.2",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "waydeshi"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "pjfanning"
        }
      ],
      "datePublic": "2026-07-29T08:05:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ejackson-databind\u0027s deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader\u0026lt;FileSystemProvider\u0026gt; and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.\u003c/p\u003e"
            }
          ],
          "value": "jackson-databind\u0027s deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader\u003cFileSystemProvider\u003e and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-610",
              "description": "CWE-610 Externally Controlled Reference to a Resource in Another Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T03:18:42.280Z",
        "orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "shortName": "HeroDevs"
      },
      "references": [
        {
          "name": "GHSA-wjgm-6hv5-3cvf",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"
        },
        {
          "name": "FasterXML/jackson-databind#6129",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/pull/6129"
        },
        {
          "name": "Fix commit (2.x line, forward-merged to 2.21 and 2.22)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551"
        },
        {
          "name": "Fix commit (3.1 line, merge of 2.x into 3.1)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d"
        },
        {
          "name": "Fix commit (3.2 line, merge of 3.1 into 3.2)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to jackson-databind 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core) or 3.1.6, 3.2.2 (tools.jackson.core). The fix introduces a URI scheme allow-list that defaults to \"file\" only. Values with no scheme are still read as local filesystem paths. Any other scheme, including jar:, is rejected via handleWeirdStringValue before the ServiceLoader\u0026lt;FileSystemProvider\u0026gt; lookup is reached, so untrusted JSON can no longer select a provider. Applications that legitimately need other schemes can construct NioPathDeserializer with an explicit collection of allowed schemes. Note that this is a behavioral change: code that previously relied on non-file schemes being resolved will need to opt in.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to jackson-databind 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core) or 3.1.6, 3.2.2 (tools.jackson.core). The fix introduces a URI scheme allow-list that defaults to \"file\" only. Values with no scheme are still read as local filesystem paths. Any other scheme, including jar:, is rejected via handleWeirdStringValue before the ServiceLoader\u003cFileSystemProvider\u003e lookup is reached, so untrusted JSON can no longer select a provider. Applications that legitimately need other schemes can construct NioPathDeserializer with an explicit collection of allowed schemes. Note that this is a behavioral change: code that previously relied on non-file schemes being resolved will need to opt in."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-29T08:05:00.000Z",
          "value": "CVE ID disclosed publicly in the title of upstream fix PR FasterXML/jackson-databind#6129"
        },
        {
          "lang": "en",
          "time": "2026-08-06T01:19:00.000Z",
          "value": "Fix merged upstream"
        },
        {
          "lang": "en",
          "time": "2026-08-21T00:00:00.000Z",
          "value": "GitHub Security Advisory GHSA-wjgm-6hv5-3cvf published by the maintainer"
        }
      ],
      "title": "jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDo not bind java.nio.file.Path-typed fields from untrusted JSON. Where a filesystem path must be accepted, deserialize it as a String and validate it in application code before converting to a Path.\u003c/p\u003e"
            }
          ],
          "value": "Do not bind java.nio.file.Path-typed fields from untrusted JSON. Where a filesystem path must be accepted, deserialize it as a String and validate it in application code before converting to a Path."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
    "assignerShortName": "HeroDevs",
    "cveId": "CVE-2026-19032",
    "datePublished": "2026-09-01T03:18:42.280Z",
    "dateReserved": "2026-08-06T03:59:24.669Z",
    "dateUpdated": "2026-09-01T13:13:09.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-19032",
      "date": "2026-09-01",
      "epss": "0.00463",
      "percentile": "0.38373"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-19032\",\"sourceIdentifier\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"published\":\"2026-09-01T04:18:00.433\",\"lastModified\":\"2026-09-01T14:17:26.437\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"jackson-databind\u0027s deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader\u003cFileSystemProvider\u003e and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.\"}],\"affected\":[{\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"affectedData\":[{\"vendor\":\"FasterXML\",\"product\":\"jackson-databind\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"packageName\":\"com.fasterxml.jackson.core:jackson-databind\",\"programFiles\":[\"src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java\"],\"programRoutines\":[{\"name\":\"com.fasterxml.jackson.databind.ext.NioPathDeserializer.deserialize\"}],\"repo\":\"https://github.com/FasterXML/jackson-databind\",\"versions\":[{\"version\":\"2.8.0\",\"lessThan\":\"2.18.10\",\"versionType\":\"maven\",\"status\":\"affected\"},{\"version\":\"2.19.0\",\"lessThan\":\"2.21.6\",\"versionType\":\"maven\",\"status\":\"affected\"},{\"version\":\"2.22.0\",\"lessThan\":\"2.22.2\",\"versionType\":\"maven\",\"status\":\"affected\"}]},{\"vendor\":\"FasterXML\",\"product\":\"jackson-databind\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"packageName\":\"tools.jackson.core:jackson-databind\",\"programFiles\":[\"src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java\"],\"programRoutines\":[{\"name\":\"tools.jackson.databind.deser.jdk.JDKFromStringDeserializer.NioPathHelper.deserialize\"}],\"repo\":\"https://github.com/FasterXML/jackson-databind\",\"versions\":[{\"version\":\"3.0.0\",\"lessThan\":\"3.1.6\",\"versionType\":\"maven\",\"status\":\"affected\"},{\"version\":\"3.2.0\",\"lessThan\":\"3.2.2\",\"versionType\":\"maven\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-01T13:12:52.665042Z\",\"id\":\"CVE-2026-19032\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-470\"},{\"lang\":\"en\",\"value\":\"CWE-610\"}]}],\"references\":[{\"url\":\"https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551\",\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\"},{\"url\":\"https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166\",\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\"},{\"url\":\"https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d\",\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\"},{\"url\":\"https://github.com/FasterXML/jackson-databind/pull/6129\",\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\"},{\"url\":\"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf\",\"source\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\"},{\"url\":\"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-19032\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-01T13:12:52.665042Z\"}}}], \"references\": [{\"url\": \"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-01T13:13:03.338Z\"}}], \"cna\": {\"title\": \"jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"waydeshi\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"pjfanning\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/FasterXML/jackson-databind\", \"vendor\": \"FasterXML\", \"product\": \"jackson-databind\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.8.0\", \"lessThan\": \"2.18.10\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"2.19.0\", \"lessThan\": \"2.21.6\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"2.22.0\", \"lessThan\": \"2.22.2\", \"versionType\": \"maven\"}], \"packageName\": \"com.fasterxml.jackson.core:jackson-databind\", \"programFiles\": [\"src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java\"], \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"com.fasterxml.jackson.databind.ext.NioPathDeserializer.deserialize\"}]}, {\"repo\": \"https://github.com/FasterXML/jackson-databind\", \"vendor\": \"FasterXML\", \"product\": \"jackson-databind\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.1.6\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"3.2.0\", \"lessThan\": \"3.2.2\", \"versionType\": \"maven\"}], \"packageName\": \"tools.jackson.core:jackson-databind\", \"programFiles\": [\"src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java\"], \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"tools.jackson.databind.deser.jdk.JDKFromStringDeserializer.NioPathHelper.deserialize\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-07-29T08:05:00.000Z\", \"value\": \"CVE ID disclosed publicly in the title of upstream fix PR FasterXML/jackson-databind#6129\"}, {\"lang\": \"en\", \"time\": \"2026-08-06T01:19:00.000Z\", \"value\": \"Fix merged upstream\"}, {\"lang\": \"en\", \"time\": \"2026-08-21T00:00:00.000Z\", \"value\": \"GitHub Security Advisory GHSA-wjgm-6hv5-3cvf published by the maintainer\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to jackson-databind 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core) or 3.1.6, 3.2.2 (tools.jackson.core). The fix introduces a URI scheme allow-list that defaults to \\\"file\\\" only. Values with no scheme are still read as local filesystem paths. Any other scheme, including jar:, is rejected via handleWeirdStringValue before the ServiceLoader\u003cFileSystemProvider\u003e lookup is reached, so untrusted JSON can no longer select a provider. Applications that legitimately need other schemes can construct NioPathDeserializer with an explicit collection of allowed schemes. Note that this is a behavioral change: code that previously relied on non-file schemes being resolved will need to opt in.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eUpgrade to jackson-databind 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core) or 3.1.6, 3.2.2 (tools.jackson.core). The fix introduces a URI scheme allow-list that defaults to \\\"file\\\" only. Values with no scheme are still read as local filesystem paths. Any other scheme, including jar:, is rejected via handleWeirdStringValue before the ServiceLoader\u0026lt;FileSystemProvider\u0026gt; lookup is reached, so untrusted JSON can no longer select a provider. Applications that legitimately need other schemes can construct NioPathDeserializer with an explicit collection of allowed schemes. Note that this is a behavioral change: code that previously relied on non-file schemes being resolved will need to opt in.\u003c/p\u003e\", \"base64\": false}]}], \"datePublic\": \"2026-07-29T08:05:00.000Z\", \"references\": [{\"url\": \"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf\", \"name\": \"GHSA-wjgm-6hv5-3cvf\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/FasterXML/jackson-databind/pull/6129\", \"name\": \"FasterXML/jackson-databind#6129\", \"tags\": [\"patch\", \"issue-tracking\"]}, {\"url\": \"https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551\", \"name\": \"Fix commit (2.x line, forward-merged to 2.21 and 2.22)\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d\", \"name\": \"Fix commit (3.1 line, merge of 2.x into 3.1)\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166\", \"name\": \"Fix commit (3.2 line, merge of 3.1 into 3.2)\", \"tags\": [\"patch\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Do not bind java.nio.file.Path-typed fields from untrusted JSON. Where a filesystem path must be accepted, deserialize it as a String and validate it in application code before converting to a Path.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eDo not bind java.nio.file.Path-typed fields from untrusted JSON. Where a filesystem path must be accepted, deserialize it as a String and validate it in application code before converting to a Path.\u003c/p\u003e\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"jackson-databind\u0027s deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader\u003cFileSystemProvider\u003e and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003ejackson-databind\u0027s deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader\u0026lt;FileSystemProvider\u0026gt; and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-470\", \"description\": \"CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-610\", \"description\": \"CWE-610 Externally Controlled Reference to a Resource in Another Sphere\"}]}], \"providerMetadata\": {\"orgId\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"shortName\": \"HeroDevs\", \"dateUpdated\": \"2026-09-01T03:18:42.280Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-19032\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-01T13:13:09.928Z\", \"dateReserved\": \"2026-08-06T03:59:24.669Z\", \"assignerOrgId\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"datePublished\": \"2026-09-01T03:18:42.280Z\", \"assignerShortName\": \"HeroDevs\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-19032

Vulnerability from fkie_nvd - Published: 2026-09-01 04:18 - Updated: 2026-09-01 14:17

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	36c7be3b-2937-45df-85ea-ca7133ea542c	https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551
	36c7be3b-2937-45df-85ea-ca7133ea542c	https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166
	36c7be3b-2937-45df-85ea-ca7133ea542c	https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d
	36c7be3b-2937-45df-85ea-ca7133ea542c	https://github.com/FasterXML/jackson-databind/pull/6129
	36c7be3b-2937-45df-85ea-ca7133ea542c	https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.fasterxml.jackson.core:jackson-databind",
          "product": "jackson-databind",
          "programFiles": [
            "src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java"
          ],
          "programRoutines": [
            {
              "name": "com.fasterxml.jackson.databind.ext.NioPathDeserializer.deserialize"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-databind",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "2.18.10",
              "status": "affected",
              "version": "2.8.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.21.6",
              "status": "affected",
              "version": "2.19.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2.22.2",
              "status": "affected",
              "version": "2.22.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "tools.jackson.core:jackson-databind",
          "product": "jackson-databind",
          "programFiles": [
            "src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java"
          ],
          "programRoutines": [
            {
              "name": "tools.jackson.databind.deser.jdk.JDKFromStringDeserializer.NioPathHelper.deserialize"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-databind",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "3.1.6",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "3.2.2",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "jackson-databind\u0027s deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader\u003cFileSystemProvider\u003e and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."
    }
  ],
  "id": "CVE-2026-19032",
  "lastModified": "2026-09-01T14:17:26.437",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-19032",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-01T13:12:52.665042Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-01T04:18:00.433",
  "references": [
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551"
    },
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166"
    },
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d"
    },
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://github.com/FasterXML/jackson-databind/pull/6129"
    },
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"
    }
  ],
  "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-470"
        },
        {
          "lang": "en",
          "value": "CWE-610"
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "type": "Secondary"
    }
  ]
}

ubuntu-cve-2026-19032

Vulnerability from osv_ubuntu

Published

2026-09-01 00:00

Modified

2026-09-01 00:00

Summary

Details

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-19032	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-19032	REPORT
	https://github.com/FasterXML/jackson-databind/com…	REPORT
	https://github.com/FasterXML/jackson-databind/com…	REPORT
	https://github.com/FasterXML/jackson-databind/com…	REPORT
	https://github.com/FasterXML/jackson-databind/pull/6129	REPORT
	https://github.com/FasterXML/jackson-databind/sec…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson-json-java",
            "binary_version": "1.9.2-3+deb8u1build0.14.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "libjackson-json-java",
        "purl": "pkg:deb/ubuntu/libjackson-json-java@1.9.2-3+deb8u1build0.14.04.1~esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.2-1",
        "1.9.2-2",
        "1.9.2-3",
        "1.9.2-3+deb8u1build0.14.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson-json-java",
            "binary_version": "1.9.2-7ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libjackson-json-java",
        "purl": "pkg:deb/ubuntu/libjackson-json-java@1.9.2-7ubuntu0.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.2-3",
        "1.9.2-4",
        "1.9.2-5",
        "1.9.2-6",
        "1.9.2-7",
        "1.9.2-7ubuntu0.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson-json-java",
            "binary_version": "1.9.13-1~18.04"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libjackson-json-java",
        "purl": "pkg:deb/ubuntu/libjackson-json-java@1.9.13-1~18.04?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.2-8",
        "1.9.2-9",
        "1.9.13-1~18.04"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson-json-java",
            "binary_version": "1.9.13-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libjackson-json-java",
        "purl": "pkg:deb/ubuntu/libjackson-json-java@1.9.13-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.13-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson-json-java",
            "binary_version": "1.9.13-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libjackson-json-java",
        "purl": "pkg:deb/ubuntu/libjackson-json-java@1.9.13-2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.13-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson-json-java",
            "binary_version": "1.9.13-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libjackson-json-java",
        "purl": "pkg:deb/ubuntu/libjackson-json-java@1.9.13-2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.13-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson-json-java",
            "binary_version": "1.9.13-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libjackson-json-java",
        "purl": "pkg:deb/ubuntu/libjackson-json-java@1.9.13-2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.13-2"
      ]
    }
  ],
  "aliases": [],
  "details": "jackson-databind\u0027s deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader\u003cFileSystemProvider\u003e and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.",
  "id": "UBUNTU-CVE-2026-19032",
  "modified": "2026-09-01T00:00:00Z",
  "published": "2026-09-01T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-19032"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19032"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/FasterXML/jackson-databind/pull/6129"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-19032"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-19032 (GCVE-0-2026-19032)

FKIE_CVE-2026-19032

ubuntu-cve-2026-19032

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature