Read the docs
TI-2026-15553 Aliases CVE-2026-19032GHSA-wjgm-6hv5-3cvf

jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path

Priority MEDIUM 63CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 2 fixed, 33 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00572 47th percentileScored 2026-11-07
Fix Partial jackson-databind (FasterXML): 2.18.10, 2.21.6, 2.22.2 +2tools.jackson.core:jackson-databind (Maven): 3.1.6, 3.2.2+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 33 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-databind2.8.0 to before 2.18.10; 2.19.0 to before 2.21.6; 2.22.0 to before 2.22.22.18.10, 2.21.6, 2.22.2Patch availableCNA
FasterXMLjackson-databind3.0.0 to before 3.1.6; 3.2.0 to before 3.2.23.1.6, 3.2.2Patch availableCNA
—tools.jackson.core:jackson-databind (Maven)3.0.0 to before 3.1.63.1.6Patch availableGHSA-wjgm-6hv5-3cvf
—tools.jackson.core:jackson-databind (Maven)3.2.0 to before 3.2.23.2.2Patch availableGHSA-wjgm-6hv5-3cvf
—com.fasterxml.jackson.core:jackson-databind (Maven)2.8.0 to before 2.18.102.18.10Patch availableGHSA-wjgm-6hv5-3cvf
—com.fasterxml.jackson.core:jackson-databind (Maven)2.19.0 to before 2.21.62.21.6Patch availableGHSA-wjgm-6hv5-3cvf
—com.fasterxml.jackson.core:jackson-databind (Maven)2.22.0 to before 2.22.22.22.2Patch availableGHSA-wjgm-6hv5-3cvf
  • jackson-databind VendorFasterXML Affected 2.8.0 to before 2.18.10; 2.19.0 to before 2.21.6; 2.22.0 to before 2.22.2 Fixed in 2.18.10, 2.21.6, 2.22.2 Patch available CNA
  • jackson-databind VendorFasterXML Affected 3.0.0 to before 3.1.6; 3.2.0 to before 3.2.2 Fixed in 3.1.6, 3.2.2 Patch available CNA
  • tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.0.0 to before 3.1.6 Fixed in 3.1.6 Patch available GHSA-wjgm-6hv5-3cvf
  • tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.2.0 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-wjgm-6hv5-3cvf
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.8.0 to before 2.18.10 Fixed in 2.18.10 Patch available GHSA-wjgm-6hv5-3cvf
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.19.0 to before 2.21.6 Fixed in 2.21.6 Patch available GHSA-wjgm-6hv5-3cvf
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.22.0 to before 2.22.2 Fixed in 2.22.2 Patch available GHSA-wjgm-6hv5-3cvf

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*——FasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions — — ·FasterXML

Remediation

  • Fix · CNA jackson-databind (FasterXML) Fixed in 2.18.10, 2.21.6, 2.22.2
  • Fix · CNA jackson-databind (FasterXML) Fixed in 3.1.6, 3.2.2
  • Fix · GHSA-wjgm-6hv5-3cvf tools.jackson.core:jackson-databind (Maven) Fixed in 3.1.6 Advisory →
  • Fix · GHSA-wjgm-6hv5-3cvf tools.jackson.core:jackson-databind (Maven) Fixed in 3.2.2 Advisory →
  • Fix · GHSA-wjgm-6hv5-3cvf com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.18.10 Advisory →
  • Fix · GHSA-wjgm-6hv5-3cvf com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.21.6 Advisory →
  • Fix · GHSA-wjgm-6hv5-3cvf com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.22.2 Advisory →

Red Hat 2 advisories

  • RHSA-2026:83520 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.4 release and security update
    • Red Hat build of Quarkus 3.33.4.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +10
  • RHSA-2026:83082 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.6 release and security update
    • Red Hat build of Quarkus 3.27.6.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FasterXML jackson-databind 2.18.10, 2.21.6 and 3 more versions

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-57688 jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base typesPriority MEDIUM 58
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix planned: Out of support scope
OpenShift Developer Tools and ServicesAffectedNo fix planned: Out of support scope
OpenShift ServerlessAffectedNo fix yet: Fix deferred
Red Hat AI Inference ServerAffectedNo fix yet: Fix deferred
Red Hat AMQ Broker 7AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Build of KeycloakAffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Certificate System 10AffectedNo fix planned: Out of support scope
Red Hat Certificate System 11AffectedNo fix yet: Fix deferred
Red Hat Data Grid 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred
Red Hat JBoss Web Server 7AffectedNo fix yet: Fix deferred
Red Hat Lightspeed for Runtimes OperatorAffectedNo fix yet: Fix deferred
Red Hat Offline Knowledge PortalAffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat Single Sign-On 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred
Red Hat build of Apicurio Registry 3AffectedNo fix yet: Fix deferred
Red Hat build of Debezium 3AffectedNo fix yet: Fix deferred
Red Hat build of Quarkus 3.27.6.redhatFixed RHSA-2026:83082
Red Hat build of Quarkus 3.33.4.redhatFixed RHSA-2026:83520
Not affected: 3 products
  • Red Hat Hardened Images
  • Red Hat build of Quarkus 3.27.6.redhat
  • Red Hat build of Quarkus 3.33.4.redhat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19032
  2. 2026-10-03 Alias added: GHSA-wjgm-6hv5-3cvf
  3. 2026-10-16 Fix available: RHSA-2026:83520 · Red Hat
  4. 2026-10-16 Fix available: RHSA-2026:83082 · Red Hat
  5. 2026-10-16 Fix available: Red Hat build of Quarkus 3.27.6.redhat, Red Hat build of Quarkus 3.33.4.redhat · Red Hat

References

Patch 4

Advisory 2

Other 6

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
  • TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
  • TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences