CVE-2026-19032
published 2026-09-01CVE-2026-19032: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In…
PriorityP434medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.46%
38.8th percentile
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.
Affected
80 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | de-minimal-rhel8 | — | — |
| ansible-automation-platform-24 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-25 | de-minimal-rhel8 | — | — |
| ansible-automation-platform-25 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| candlepinproject | candlepin | — | — |
| debian | ceph | — | — |
| debian | dogtag-pki | — | — |
| debian | puppetserver | — | — |
| devspaces | multicluster-redirector-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| devspaces | server-rhel9 | — | — |
| exploit-intelligence | agent-client-rhel9 | — | — |
| fasterxml | jackson-databind | — | — |
| fasterxml | jackson-databind | >= 2.19.0 < 2.21.6 | 2.21.6 |
| fasterxml | jackson-databind | >= 2.22.0 < 2.22.2 | 2.22.2 |
| fasterxml | jackson-databind | >= 2.8.0 < 2.18.10 | 2.18.10 |
| fasterxml | jackson-databind | >= 3.0.0 < 3.1.6 | 3.1.6 |
| fasterxml | jackson-databind | >= 3.2.0 < 3.2.2 | 3.2.2 |
| jboss-eap-7 | eap74-els-openjdk11-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk17-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk8-openshift-rhel8 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-19032 python-avro: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
bugzilla·2026-09-03·CVSS 5.3
CVE-2026-19032 [MEDIUM] CVE-2026-19032 python-avro: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
CVE-2026-19032 python-avro: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Unt
Bugzilla
CVE-2026-19032 jetty: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
bugzilla·2026-09-03·CVSS 5.3
CVE-2026-19032 [MEDIUM] CVE-2026-19032 jetty: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
CVE-2026-19032 jetty: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted
Bugzilla
CVE-2026-19032 byte-buddy: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
bugzilla·2026-09-03·CVSS 5.3
CVE-2026-19032 [MEDIUM] CVE-2026-19032 byte-buddy: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
CVE-2026-19032 byte-buddy: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untr
Bugzilla
CVE-2026-19032 log4j: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
bugzilla·2026-09-03·CVSS 5.3
CVE-2026-19032 [MEDIUM] CVE-2026-19032 log4j: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
CVE-2026-19032 log4j: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted
Bugzilla
CVE-2026-19032 google-gson: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [epel-all]
bugzilla·2026-09-03·CVSS 5.3
CVE-2026-19032 [MEDIUM] CVE-2026-19032 google-gson: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [epel-all]
CVE-2026-19032 google-gson: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untru
Bugzilla
CVE-2026-19032 ceph: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
bugzilla·2026-09-03·CVSS 5.3
CVE-2026-19032 [MEDIUM] CVE-2026-19032 ceph: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
CVE-2026-19032 ceph: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted
Bugzilla
CVE-2026-19032 dogtag-pki: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
bugzilla·2026-09-03·CVSS 5.3
CVE-2026-19032 [MEDIUM] CVE-2026-19032 dogtag-pki: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
CVE-2026-19032 dogtag-pki: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untr
Bugzilla
CVE-2026-19032 google-gson: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
bugzilla·2026-09-03·CVSS 5.3
CVE-2026-19032 [MEDIUM] CVE-2026-19032 google-gson: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
CVE-2026-19032 google-gson: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Unt
Bugzilla
CVE-2026-19032 jackson-bom: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
bugzilla·2026-09-03·CVSS 5.3
CVE-2026-19032 [MEDIUM] CVE-2026-19032 jackson-bom: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
CVE-2026-19032 jackson-bom: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Unt
Bugzilla
CVE-2026-19032 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization
bugzilla·2026-09-01·CVSS 5.3
CVE-2026-19032 [MEDIUM] CVE-2026-19032 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization
CVE-2026-19032 com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at t
https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6dhttps://github.com/FasterXML/jackson-databind/pull/6129https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvfhttps://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf
2026-09-01
Published