{"api_version":"1","generated_at":"2026-09-08T09:13:33+00:00","cve":"CVE-2026-19032","urls":{"html":"https://cve.report/CVE-2026-19032","api":"https://cve.report/api/cve/CVE-2026-19032.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-19032","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032"},"summary":{"title":"jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path","description":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.","state":"PUBLISHED","assigner":"HeroDevs","published_at":"2026-09-01 04:18:00","updated_at":"2026-09-01 14:17:26"},"problem_types":["CWE-470","CWE-610","CWE-470 CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","CWE-610 CWE-610 Externally Controlled Reference to a Resource in Another Sphere"],"metrics":[{"version":"3.1","source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","name":"https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","refsource":"36c7be3b-2937-45df-85ea-ca7133ea542c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","name":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","name":"https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","refsource":"36c7be3b-2937-45df-85ea-ca7133ea542c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","name":"https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","refsource":"36c7be3b-2937-45df-85ea-ca7133ea542c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/FasterXML/jackson-databind/pull/6129","name":"https://github.com/FasterXML/jackson-databind/pull/6129","refsource":"36c7be3b-2937-45df-85ea-ca7133ea542c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19032","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"FasterXML","product":"jackson-databind","version":"affected 2.8.0 2.18.10 maven","platforms":[]},{"source":"CNA","vendor":"FasterXML","product":"jackson-databind","version":"affected 2.19.0 2.21.6 maven","platforms":[]},{"source":"CNA","vendor":"FasterXML","product":"jackson-databind","version":"affected 2.22.0 2.22.2 maven","platforms":[]},{"source":"CNA","vendor":"FasterXML","product":"jackson-databind","version":"affected 3.0.0 3.1.6 maven","platforms":[]},{"source":"CNA","vendor":"FasterXML","product":"jackson-databind","version":"affected 3.2.0 3.2.2 maven","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-07-29T08:05:00.000Z","lang":"en","value":"CVE ID disclosed publicly in the title of upstream fix PR FasterXML/jackson-databind#6129"},{"source":"CNA","time":"2026-08-06T01:19:00.000Z","lang":"en","value":"Fix merged upstream"},{"source":"CNA","time":"2026-08-21T00:00:00.000Z","lang":"en","value":"GitHub Security Advisory GHSA-wjgm-6hv5-3cvf published by the maintainer"}],"solutions":[{"source":"CNA","title":"","value":"Upgrade to jackson-databind 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core) or 3.1.6, 3.2.2 (tools.jackson.core). The fix introduces a URI scheme allow-list that defaults to \"file\" only. Values with no scheme are still read as local filesystem paths. Any other scheme, including jar:, is rejected via handleWeirdStringValue before the ServiceLoader<FileSystemProvider> lookup is reached, so untrusted JSON can no longer select a provider. Applications that legitimately need other schemes can construct NioPathDeserializer with an explicit collection of allowed schemes. Note that this is a behavioral change: code that previously relied on non-file schemes being resolved will need to opt in.","time":"","lang":"en"}],"workarounds":[{"source":"CNA","title":"","value":"Do not bind java.nio.file.Path-typed fields from untrusted JSON. Where a filesystem path must be accepted, deserialize it as a String and validate it in application code before converting to a Path.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"waydeshi","lang":"en"},{"source":"CNA","value":"pjfanning","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"19032","cve":"CVE-2026-19032","epss":"0.004630000","percentile":"0.384210000","score_date":"2026-09-02","updated_at":"2026-09-03 00:14:37"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-19032","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-01T13:12:52.665042Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-01T13:13:09.928Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.fasterxml.jackson.core:jackson-databind","product":"jackson-databind","programFiles":["src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java"],"programRoutines":[{"name":"com.fasterxml.jackson.databind.ext.NioPathDeserializer.deserialize"}],"repo":"https://github.com/FasterXML/jackson-databind","vendor":"FasterXML","versions":[{"lessThan":"2.18.10","status":"affected","version":"2.8.0","versionType":"maven"},{"lessThan":"2.21.6","status":"affected","version":"2.19.0","versionType":"maven"},{"lessThan":"2.22.2","status":"affected","version":"2.22.0","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"tools.jackson.core:jackson-databind","product":"jackson-databind","programFiles":["src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java"],"programRoutines":[{"name":"tools.jackson.databind.deser.jdk.JDKFromStringDeserializer.NioPathHelper.deserialize"}],"repo":"https://github.com/FasterXML/jackson-databind","vendor":"FasterXML","versions":[{"lessThan":"3.1.6","status":"affected","version":"3.0.0","versionType":"maven"},{"lessThan":"3.2.2","status":"affected","version":"3.2.0","versionType":"maven"}]}],"credits":[{"lang":"en","type":"reporter","value":"waydeshi"},{"lang":"en","type":"remediation developer","value":"pjfanning"}],"datePublic":"2026-07-29T08:05:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader&lt;FileSystemProvider&gt; and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.</p>"}],"value":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-470","description":"CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-610","description":"CWE-610 Externally Controlled Reference to a Resource in Another Sphere","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-01T03:18:42.280Z","orgId":"36c7be3b-2937-45df-85ea-ca7133ea542c","shortName":"HeroDevs"},"references":[{"name":"GHSA-wjgm-6hv5-3cvf","tags":["third-party-advisory"],"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"},{"name":"FasterXML/jackson-databind#6129","tags":["patch","issue-tracking"],"url":"https://github.com/FasterXML/jackson-databind/pull/6129"},{"name":"Fix commit (2.x line, forward-merged to 2.21 and 2.22)","tags":["patch"],"url":"https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551"},{"name":"Fix commit (3.1 line, merge of 2.x into 3.1)","tags":["patch"],"url":"https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d"},{"name":"Fix commit (3.2 line, merge of 3.1 into 3.2)","tags":["patch"],"url":"https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Upgrade to jackson-databind 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core) or 3.1.6, 3.2.2 (tools.jackson.core). The fix introduces a URI scheme allow-list that defaults to \"file\" only. Values with no scheme are still read as local filesystem paths. Any other scheme, including jar:, is rejected via handleWeirdStringValue before the ServiceLoader&lt;FileSystemProvider&gt; lookup is reached, so untrusted JSON can no longer select a provider. Applications that legitimately need other schemes can construct NioPathDeserializer with an explicit collection of allowed schemes. Note that this is a behavioral change: code that previously relied on non-file schemes being resolved will need to opt in.</p>"}],"value":"Upgrade to jackson-databind 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core) or 3.1.6, 3.2.2 (tools.jackson.core). The fix introduces a URI scheme allow-list that defaults to \"file\" only. Values with no scheme are still read as local filesystem paths. Any other scheme, including jar:, is rejected via handleWeirdStringValue before the ServiceLoader<FileSystemProvider> lookup is reached, so untrusted JSON can no longer select a provider. Applications that legitimately need other schemes can construct NioPathDeserializer with an explicit collection of allowed schemes. Note that this is a behavioral change: code that previously relied on non-file schemes being resolved will need to opt in."}],"source":{"discovery":"EXTERNAL"},"timeline":[{"lang":"en","time":"2026-07-29T08:05:00.000Z","value":"CVE ID disclosed publicly in the title of upstream fix PR FasterXML/jackson-databind#6129"},{"lang":"en","time":"2026-08-06T01:19:00.000Z","value":"Fix merged upstream"},{"lang":"en","time":"2026-08-21T00:00:00.000Z","value":"GitHub Security Advisory GHSA-wjgm-6hv5-3cvf published by the maintainer"}],"title":"jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Do not bind java.nio.file.Path-typed fields from untrusted JSON. Where a filesystem path must be accepted, deserialize it as a String and validate it in application code before converting to a Path.</p>"}],"value":"Do not bind java.nio.file.Path-typed fields from untrusted JSON. Where a filesystem path must be accepted, deserialize it as a String and validate it in application code before converting to a Path."}]}},"cveMetadata":{"assignerOrgId":"36c7be3b-2937-45df-85ea-ca7133ea542c","assignerShortName":"HeroDevs","cveId":"CVE-2026-19032","datePublished":"2026-09-01T03:18:42.280Z","dateReserved":"2026-08-06T03:59:24.669Z","dateUpdated":"2026-09-01T13:13:09.928Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-01 04:18:00","lastModifiedDate":"2026-09-01 14:17:26","problem_types":["CWE-470","CWE-610","CWE-470 CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","CWE-610 CWE-610 Externally Controlled Reference to a Resource in Another Sphere"],"metrics":{"cvssMetricV31":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-01T13:12:52.665042Z","id":"CVE-2026-19032","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"19032","Ordinal":"1","Title":"jackson-databind resolves attacker-controlled URI schemes when d","CVE":"CVE-2026-19032","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"19032","Ordinal":"1","NoteData":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.","Type":"Description","Title":"jackson-databind resolves attacker-controlled URI schemes when d"}]}}}