CVE-Katalog

CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path…

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

Schweregrad: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Aug 16, 2026, 10:00:00 PM UTC
Updated: Sep 1, 2026, 4:18:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.57% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	jackson-databind	`2.18.11-1`	FixedDistribution-reported fixed boundary	[CVE-2026-19032]
Debiansid	jackson-databind	`2.22.4-1`	Fixed	[CVE-2026-19032]
Debianforky	jackson-databind	`2.18.11-1`	FixedDistribution-reported fixed boundary	[CVE-2026-19032]
Debianforky	jackson-databind	`2.22.4-1`	Fixed	[CVE-2026-19032]
MavenRelease not reported	com.fasterxml.jackson.core:jackson-databind	`2.22.2`	Fixed	[GHSA-WJGM-6HV5-3CVF]Sep 28, 2026, 8:19:22 PM UTC
MavenRelease not reported	tools.jackson.core:jackson-databind	`3.2.2`	Fixed	[GHSA-WJGM-6HV5-3CVF]Sep 28, 2026, 8:19:22 PM UTC

Showing 6 fix observations. All 13 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
MavenRelease not reported	com.fasterxml.jackson.core:jackson-databind	`2.22.2`	Fixed	[GHSA-WJGM-6HV5-3CVF]Sep 28, 2026, 8:19:22 PM UTC
MavenRelease not reported	tools.jackson.core:jackson-databind	`3.2.2`	Fixed	[GHSA-WJGM-6HV5-3CVF]Sep 28, 2026, 8:19:22 PM UTC
Debianbookworm	jackson-databind	Not reported	AffectedDistribution reports no fix	[CVE-2026-19032]
Debianbookworm	jackson-databind	`2.14.0-1+deb12u1`	Affected	[CVE-2026-19032]
Debianbookworm-security	jackson-databind	`2.14.0-1+deb12u1`	Affected	[CVE-2026-19032]
Debianforky	jackson-databind	`2.18.11-1`	FixedDistribution-reported fixed boundary	[CVE-2026-19032]
Debianforky	jackson-databind	`2.22.4-1`	Fixed	[CVE-2026-19032]
Debiansid	jackson-databind	`2.18.11-1`	FixedDistribution-reported fixed boundary	[CVE-2026-19032]
Debiansid	jackson-databind	`2.22.4-1`	Fixed	[CVE-2026-19032]
Debiantrixie	jackson-databind	Not reported	AffectedDistribution reports no fix	[CVE-2026-19032]
Debiantrixie	jackson-databind	`2.14.0+ds-1+deb13u1`	Affected	[CVE-2026-19032]
Debiantrixie-security	jackson-databind	`2.14.0+ds-1+deb13u1`	Affected	[CVE-2026-19032]
Opensusetumbleweed	jackson-databind	`2.18.11-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:11877-1]Sep 25, 2026, 6:23:08 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "jackson-databind",
      "status": "fixed",
      "release": "sid",
      "version": "2.22.4-1"
    },
    {
      "name": "jackson-databind",
      "status": "fixed",
      "release": "forky",
      "version": "2.22.4-1"
    },
    {
      "name": "jackson-databind",
      "status": "vulnerable",
      "release": "trixie",
      "version": "2.14.0+ds-1+deb13u1"
    },
    {
      "name": "jackson-databind",
      "status": "vulnerable",
      "release": "trixie-security",
      "version": "2.14.0+ds-1+deb13u1"
    },
    {
      "name": "jackson-databind",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "2.14.0-1+deb12u1"
    },
    {
      "name": "jackson-databind",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "2.14.0-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1148830,
      "name": "jackson-databind",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.18.11-1"
    },
    {
      "bug": 1148830,
      "name": "jackson-databind",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2.18.11-1"
    },
    {
      "bug": 1148830,
      "name": "jackson-databind",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": 1148830,
      "name": "jackson-databind",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "tools.jackson.core:jackson-databind",
      "ecosystem": "maven",
      "provider_url": "https://github.com/advisories/GHSA-wjgm-6hv5-3cvf",
      "fixed_version": "3.2.2",
      "provider_source": "github",
      "provider_record_id": "GHSA-WJGM-6HV5-3CVF",
      "provider_updated_at": "2026-09-28T20:19:22Z"
    },
    {
      "name": "com.fasterxml.jackson.core:jackson-databind",
      "ecosystem": "maven",
      "provider_url": "https://github.com/advisories/GHSA-wjgm-6hv5-3cvf",
      "fixed_version": "2.22.2",
      "provider_source": "github",
      "provider_record_id": "GHSA-WJGM-6HV5-3CVF",
      "provider_updated_at": "2026-09-28T20:19:22Z"
    },
    {
      "name": "jackson-databind",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.18.11-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:11877-1",
      "fixed_version": "2.18.11-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:11877-1",
      "provider_updated_at": "2026-09-25T18:23:08.679077296Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1148830]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libjackson2-databind-java]Unbekannt
Quellpaket: [jackson-databind]
Details (4)
- 2.14.0-1+deb12u1 · all · bookworm
  Unbekannt · Behoben: 2.18.11-1
  Version impact unknown
  nvd · jackson-databind · debian · bookworm; pypi · jackson-databind · debian · 12; pypi · jackson-databind · debian · 13; pypi · jackson-databind · debian · 14
- 2.14.0-1+deb12u1 · all · bookworm
  Unbekannt · Behoben: 2.18.11-1
  Version impact unknown
  nvd · jackson-databind · debian · bookworm; pypi · jackson-databind · debian · 12; pypi · jackson-databind · debian · 13; pypi · jackson-databind · debian · 14
- 2.14.0-1+deb12u1 · all · bookworm-security
  Unbekannt · Behoben: 2.18.11-1
  Version impact unknown
  nvd · jackson-databind · debian · bookworm; pypi · jackson-databind · debian · 12; pypi · jackson-databind · debian · 13; pypi · jackson-databind · debian · 14
- 2.14.0-1+deb12u1 · all · bookworm-security
  Unbekannt · Behoben: 2.18.11-1
  Version impact unknown
  nvd · jackson-databind · debian · bookworm; pypi · jackson-databind · debian · 12; pypi · jackson-databind · debian · 13; pypi · jackson-databind · debian · 14

[Debian 13 (Trixie)]

[libjackson2-databind-java]Unbekannt
Quellpaket: [jackson-databind]
Details (4)
- 2.14.0+ds-1+deb13u1 · all · trixie
  Unbekannt · Behoben: 2.18.11-1
  Version impact unknown
  nvd · jackson-databind · debian · bookworm; pypi · jackson-databind · debian · 12; pypi · jackson-databind · debian · 13; pypi · jackson-databind · debian · 14
- 2.14.0+ds-1+deb13u1 · all · trixie
  Unbekannt · Behoben: 2.18.11-1
  Version impact unknown
  nvd · jackson-databind · debian · bookworm; pypi · jackson-databind · debian · 12; pypi · jackson-databind · debian · 13; pypi · jackson-databind · debian · 14
- 2.14.0+ds-1+deb13u1 · all · trixie-security
  Unbekannt · Behoben: 2.18.11-1
  Version impact unknown
  nvd · jackson-databind · debian · bookworm; pypi · jackson-databind · debian · 12; pypi · jackson-databind · debian · 13; pypi · jackson-databind · debian · 14
- 2.14.0+ds-1+deb13u1 · all · trixie-security
  Unbekannt · Behoben: 2.18.11-1
  Version impact unknown
  nvd · jackson-databind · debian · bookworm; pypi · jackson-databind · debian · 12; pypi · jackson-databind · debian · 13; pypi · jackson-databind · debian · 14

[openSUSE Leap 15.6]

[jackson-databind]Unbekannt
Quellpaket: [jackson-databind]
Details (1)
- 2.15.2-150200.3.15.1 · noarch · leap-15.6
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed
[jackson-databind-javadoc]Unbekannt
Quellpaket: [jackson-databind]
Details (1)
- 2.15.2-150200.3.15.1 · noarch · leap-15.6
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed

[openSUSE Leap 16.0]

[jackson-databind]Unbekannt
Quellpaket: [jackson-databind]
Details (4)
- 2.17.3-160000.2.2 · noarch · leap-16.0
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed
- 2.17.3-160000.3.1 · noarch · leap-16.0
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed
- 2.18.8-160000.1.1 · noarch · leap-16.0
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed
- 2.18.9-160000.1.1 · noarch · leap-16.0
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed
[jackson-databind-javadoc]Unbekannt
Quellpaket: [jackson-databind]
Details (4)
- 2.17.3-160000.2.2 · noarch · leap-16.0
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed
- 2.17.3-160000.3.1 · noarch · leap-16.0
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed
- 2.18.8-160000.1.1 · noarch · leap-16.0
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed
- 2.18.9-160000.1.1 · noarch · leap-16.0
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed

[openSUSE Tumbleweed]

[jackson-databind]Unbekannt
Quellpaket: [jackson-databind]
Details (1)
- 2.18.9-2.2 · noarch · tumbleweed
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed
[jackson-databind-javadoc]Unbekannt
Quellpaket: [jackson-databind]
Details (1)
- 2.18.9-2.2 · noarch · tumbleweed
  Unbekannt · Behoben: 2.18.11-1.1
  Version impact unknown
  pypi · jackson-databind · opensuse · tumbleweed

Beobachtet: Oct 29, 2026, 10:10:29 AM UTC

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]