jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
Summary
| CVE | CVE-2026-19032 |
|---|---|
| State | PUBLISHED |
| Assigner | HeroDevs |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-01 04:18:00 UTC |
| Updated | 2026-09-01 14:17:26 UTC |
| Description | jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version. |
Risk And Classification
Primary CVSS: v3.1 5.3 MEDIUM from 36c7be3b-2937-45df-85ea-ca7133ea542c
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS: 0.004630000 probability, percentile 0.384210000 (date 2026-09-02)
Problem Types: CWE-470 | CWE-610 | CWE-470 CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | CWE-610 CWE-610 Externally Controlled Reference to a Resource in Another Sphere
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 36c7be3b-2937-45df-85ea-ca7133ea542c | Secondary | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | CNA | CVSS | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | FasterXML | Jackson-databind | affected 2.8.0 2.18.10 maven | Not specified |
| CNA | FasterXML | Jackson-databind | affected 2.19.0 2.21.6 maven | Not specified |
| CNA | FasterXML | Jackson-databind | affected 2.22.0 2.22.2 maven | Not specified |
| CNA | FasterXML | Jackson-databind | affected 3.0.0 3.1.6 maven | Not specified |
| CNA | FasterXML | Jackson-databind | affected 3.2.0 3.2.2 maven | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ff... | 36c7be3b-2937-45df-85ea-ca7133ea542c | github.com | |
| github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5... | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | |
| github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909a... | 36c7be3b-2937-45df-85ea-ca7133ea542c | github.com | |
| github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e04... | 36c7be3b-2937-45df-85ea-ca7133ea542c | github.com | |
| github.com/FasterXML/jackson-databind/pull/6129 | 36c7be3b-2937-45df-85ea-ca7133ea542c | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: waydeshi (en)
CNA: pjfanning (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-07-29T08:05:00.000Z | CVE ID disclosed publicly in the title of upstream fix PR FasterXML/jackson-databind#6129 |
| CNA | 2026-08-06T01:19:00.000Z | Fix merged upstream |
| CNA | 2026-08-21T00:00:00.000Z | GitHub Security Advisory GHSA-wjgm-6hv5-3cvf published by the maintainer |
Solutions
CNA: Upgrade to jackson-databind 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core) or 3.1.6, 3.2.2 (tools.jackson.core). The fix introduces a URI scheme allow-list that defaults to "file" only. Values with no scheme are still read as local filesystem paths. Any other scheme, including jar:, is rejected via handleWeirdStringValue before the ServiceLoader<FileSystemProvider> lookup is reached, so untrusted JSON can no longer select a provider. Applications that legitimately need other schemes can construct NioPathDeserializer with an explicit collection of allowed schemes. Note that this is a behavioral change: code that previously relied on non-file schemes being resolved will need to opt in.
Workarounds
CNA: Do not bind java.nio.file.Path-typed fields from untrusted JSON. Where a filesystem path must be accepted, deserialize it as a String and validate it in application code before converting to a Path.