CVE-2026-19032

Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.core:jackson-databind versions 2.8.0 through 2.18.9 com.fasterxml.jackson.core:jackson-databind versions 2.19.0 through 2.21.5 com.fasterxml.jackson.core:jackson-databind versions 2.22.0 through 2.22.1 tools.jackson.core:jackson-databind versions 3.0.0 through 3.1.5 tools.jackson.core:jackson-databind versions 3.2.0 through 3.2.1

Description The deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In the JDKFromStringDeserializer.NioPathHelper.deserialize function, a string from untrusted JSON is passed to new URI(value) and then to Path.of(uri). If a FileSystemNotFoundException occurs, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider matching the attacker-chosen scheme. This allows untrusted JSON to select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, forcing provider class loading. While the resolved path is inert with only JDK built-in providers (file, jar/zipfs), further impact is possible if a side-effecting third-party FileSystemProvider is present on the classpath.

Recommendations Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.10 Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.6 Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.22.2 Upgrade tools.jackson.core:jackson-databind to version 3.1.6 Upgrade tools.jackson.core:jackson-databind to version 3.2.2 Avoid binding java.nio.file.Path from untrusted JSON regardless of the version used.