{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19032", "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "state": "PUBLISHED", "assignerShortName": "HeroDevs", "dateReserved": "2026-08-06T03:59:24.669Z", "datePublished": "2026-09-01T03:18:42.280Z", "dateUpdated": "2026-09-01T03:18:42.280Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "shortName": "HeroDevs", "dateUpdated": "2026-09-01T03:18:42.280Z"}, "title": "jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path", "datePublic": "2026-07-29T08:05:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-470", "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-610", "description": "CWE-610 Externally Controlled Reference to a Resource in Another Sphere", "type": "CWE"}]}], "affected": [{"vendor": "FasterXML", "product": "jackson-databind", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "com.fasterxml.jackson.core:jackson-databind", "repo": "https://github.com/FasterXML/jackson-databind", "programFiles": ["src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java"], "programRoutines": [{"name": "com.fasterxml.jackson.databind.ext.NioPathDeserializer.deserialize"}], "versions": [{"status": "affected", "version": "2.8.0", "lessThan": "2.18.10", "versionType": "maven"}, {"status": "affected", "version": "2.19.0", "lessThan": "2.21.6", "versionType": "maven"}, {"status": "affected", "version": "2.22.0", "lessThan": "2.22.2", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "FasterXML", "product": "jackson-databind", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "tools.jackson.core:jackson-databind", "repo": "https://github.com/FasterXML/jackson-databind", "programFiles": ["src/main/java/tools/jackson/databind/deser/jdk/JDKFromStringDeserializer.java"], "programRoutines": [{"name": "tools.jackson.databind.deser.jdk.JDKFromStringDeserializer.NioPathHelper.deserialize"}], "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.1.6", "versionType": "maven"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.2", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader&lt;FileSystemProvider&gt; and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.</p>"}]}], "references": [{"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf", "name": "GHSA-wjgm-6hv5-3cvf", "tags": ["third-party-advisory"]}, {"url": "https://github.com/FasterXML/jackson-databind/pull/6129", "name": "FasterXML/jackson-databind#6129", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551", "name": "Fix commit (2.x line, forward-merged to 2.21 and 2.22)", "tags": ["patch"]}, {"url": "https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d", "name": "Fix commit (3.1 line, merge of 2.x into 3.1)", "tags": ["patch"]}, {"url": "https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166", "name": "Fix commit (3.2 line, merge of 3.1 into 3.2)", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}}], "workarounds": [{"lang": "en", "value": "Do not bind java.nio.file.Path-typed fields from untrusted JSON. Where a filesystem path must be accepted, deserialize it as a String and validate it in application code before converting to a Path.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Do not bind java.nio.file.Path-typed fields from untrusted JSON. Where a filesystem path must be accepted, deserialize it as a String and validate it in application code before converting to a Path.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade to jackson-databind 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core) or 3.1.6, 3.2.2 (tools.jackson.core). The fix introduces a URI scheme allow-list that defaults to \"file\" only. Values with no scheme are still read as local filesystem paths. Any other scheme, including jar:, is rejected via handleWeirdStringValue before the ServiceLoader<FileSystemProvider> lookup is reached, so untrusted JSON can no longer select a provider. Applications that legitimately need other schemes can construct NioPathDeserializer with an explicit collection of allowed schemes. Note that this is a behavioral change: code that previously relied on non-file schemes being resolved will need to opt in.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to jackson-databind 2.18.10, 2.21.6, 2.22.2 (com.fasterxml.jackson.core) or 3.1.6, 3.2.2 (tools.jackson.core). The fix introduces a URI scheme allow-list that defaults to \"file\" only. Values with no scheme are still read as local filesystem paths. Any other scheme, including jar:, is rejected via handleWeirdStringValue before the ServiceLoader&lt;FileSystemProvider&gt; lookup is reached, so untrusted JSON can no longer select a provider. Applications that legitimately need other schemes can construct NioPathDeserializer with an explicit collection of allowed schemes. Note that this is a behavioral change: code that previously relied on non-file schemes being resolved will need to opt in.</p>"}]}], "timeline": [{"time": "2026-07-29T08:05:00.000Z", "lang": "en", "value": "CVE ID disclosed publicly in the title of upstream fix PR FasterXML/jackson-databind#6129"}, {"time": "2026-08-06T01:19:00.000Z", "lang": "en", "value": "Fix merged upstream"}, {"time": "2026-08-21T00:00:00.000Z", "lang": "en", "value": "GitHub Security Advisory GHSA-wjgm-6hv5-3cvf published by the maintainer"}], "credits": [{"lang": "en", "value": "waydeshi", "type": "reporter"}, {"lang": "en", "value": "pjfanning", "type": "remediation developer"}], "source": {"discovery": "EXTERNAL"}}}}

{}

{}

{}

{}