{"id":"CVE-2026-19032","summary":"jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path","details":"jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader\u003cFileSystemProvider\u003e and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.","aliases":["GHSA-wjgm-6hv5-3cvf"],"modified":"2026-10-22T16:25:40.511089959Z","published":"2026-09-01T03:18:42.280Z","related":["SUSE-SU-2026:24149-1","SUSE-SU-2026:4394-1","openSUSE-SU-2026:11877-1","openSUSE-SU-2026:22034-1"],"database_specific":{"cwe_ids":["CWE-470","CWE-610"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","cna_assigner":"HeroDevs"},"references":[{"type":"WEB","url":"https://repo.maven.apache.org/maven2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json"},{"type":"ADVISORY","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/pull/6129"},{"type":"PACKAGE","url":"https://github.com/FasterXML/jackson-databind"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fasterxml/jackson-databind","events":[{"introduced":"81929fad84189ce59ef82e7a6d0df795eb0c7cdb"},{"fixed":"176df1d48b256ced412c65293ad4e09393e24bd3"},{"introduced":"f644a920f4ac768797edf7709070411837c83ef8"},{"fixed":"5cf4246e1be4a579dbb64c83ef06a961381ca1a2"},{"introduced":"ed2541fedfc6005fd249343f01e6090c8c3395f6"},{"fixed":"25b2a221f9aa4107e455065a74635e209418cf55"},{"introduced":"d51183e4fa171235bcd31c63268c5ad1745afb8c"},{"fixed":"1f824e37f273bc09ea268fe3a10fccafbc86a128"},{"introduced":"0f45333297a3d0504f2706c2aff2177586150d25"},{"fixed":"3fd4e6ff5b958c702829b7a652ca3bcb250763da"},{"fixed":"cc6756b61ed90b6b9227f670e0408d5d9bd48551"},{"fixed":"d94bb632becfe0ba96926b9909ab06d1f87aad6d"},{"fixed":"ce26eda3481cd796f76ba4c53ffe1da23b53f166"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.8.0"},{"fixed":"2.18.10"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"strategy":"StandardRange","range":[{"introduced":"2.19.0"},{"fixed":"2.21.6"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"2.22.0"},{"fixed":"2.22.2"}]},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"3.0.0"},{"fixed":"3.1.6"}]},{"strategy":"StandardRange","range":[{"introduced":"3.2.0"},{"fixed":"3.2.2"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"cc6756b61ed90b6b9227f670e0408d5d9bd48551"}]},{"range":[{"fixed":"d94bb632becfe0ba96926b9909ab06d1f87aad6d"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"ce26eda3481cd796f76ba4c53ffe1da23b53f166"}]}]}}],"versions":["jackson-databind-3.2.1","jackson-databind-3.1.5","jackson-databind-2.18.9","jackson-databind-2.22.1","jackson-databind-2.21.5","jackson-databind-3.2.0","jackson-databind-2.22.0","jackson-databind-3.1.4","jackson-databind-2.21.4","jackson-databind-2.18.8","jackson-databind-3.1.3","jackson-databind-2.21.3","jackson-databind-2.18.7","jackson-databind-3.1.2","jackson-databind-3.1.1","jackson-databind-2.21.2","jackson-databind-3.1.0","jackson-databind-2.21.1","jackson-databind-2.18.6","jackson-databind-3.1.0-rc1","jackson-databind-2.21.0","jackson-databind-2.18.5","jackson-databind-3.0.1","jackson-databind-3.0.0","jackson-databind-2.20.0","jackson-databind-2.20.0-rc1","jackson-databind-2.18.4","jackson-databind-2.19.0","jackson-databind-2.18.3","jackson-databind-2.18.2","jackson-databind-2.18.1","jackson-databind-2.18.0","jackson-databind-2.18.0-rc1","jackson-databind-2.17.0-rc1","jackson-databind-2.16.0","jackson-databind-2.16.0-rc1","jackson-databind-2.15.0","jackson-databind-2.15.0-rc3","jackson-databind-2.15.0-rc2","jackson-databind-2.15.0-rc1","jackson-databind-2.14.0","jackson-databind-2.14.0-rc3","jackson-databind-2.14.0-rc2","jackson-databind-2.14.0-rc1","jackson-databind-2.13.0","jackson-databind-2.13.0-rc2","jackson-databind-2.13.0-rc1","jackson-databind-2.12.1","jackson-databind-2.12.0","jackson-databind-2.12.0-rc2","jackson-databind-2.12.0-rc1","jackson-databind-2.11.0","jackson-databind-2.11.0.rc1","jackson-databind-2.10.0","jackson-databind-2.10.0.pr3","jackson-databind-2.10.0.pr2","jackson-databind-2.10.0.pr1","jackson-databind-2.9.6","jackson-databind-2.9.5","jackson-databind-2.9.4","jackson-databind-2.9.3","jackson-databind-2.9.1","jackson-databind-2.9.0","jackson-databind-2.9.0.pr4","jackson-databind-2.9.0.pr3","jackson-databind-2.9.0.pr2","jackson-databind-2.9.0.pr1","jackson-databind-2.8.2","jackson-databind-2.8.1","jackson-databind-2.8.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-19032.json","vanir_signatures":[{"id":"CVE-2026-19032-27eaae73","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","target":{"function":"NioPathDeserializer","file":"src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java"},"deprecated":false,"digest":{"length":42,"function_hash":"92101465422424467312766315937748608420"}},{"target":{"file":"src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java","function":"deserialize"},"deprecated":false,"digest":{"function_hash":"55597049715288335163113030909500275021","length":1214},"id":"CVE-2026-19032-55e89f1b","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551"},{"source":"https://github.com/fasterxml/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","target":{"file":"src/test/java/com/fasterxml/jackson/databind/ext/TestJava7Types.java"},"deprecated":false,"digest":{"line_hashes":["38990328755517105057217951891384374888","53252940433388737355468942006223042902","305537746187801192750050573096709479349","332003456633043337847232072017734042590","227141267709174992536952543542694326751","24446070781751237721171589521110893776","301709390981385491509052623040383176015","71934211663967925912815001990015054579","262547181641503716275795575097905889560"],"threshold":0.9},"id":"CVE-2026-19032-6038f3dd","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["74669015141188271777934954457126643922","287751443331097588980327327565839991908","275881310224217258236504493126731254517","12824966327844879528324417018565270581","259638742625574608223965309344486562126","79925746057226428402747885343932392479","45761526395124909112536111459624805609","123801509903514188454953506923175246158","14464742447012335842152208348844174020","231475160403169059677033835345819988837","31608732481866522795525904992736659867","260973494329495961521561722540349734016","30911285213032683860013274079239082196","111869360053250916870985718999654814124","98206619047481515196859527420817724282","256460140207216769021919033658970227600","300039073969796641330804040338178731482","211796378550913213447836695489407467800","12479808543301836511933938646038766751","108065770393464951866056107831574820906","229001283573589608755960285356017476967","135691589550867387686609915634675429836","296625428524336792878385302471426124317","235235075682315468670702525589706570916"],"threshold":0.9},"id":"CVE-2026-19032-f1d3eaaf","signature_type":"Line","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","target":{"file":"src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java"},"deprecated":false}],"vanir_signatures_modified":"2026-10-22T16:25:40Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}