CVE-2026-19032

Overview

jackson-databind is the general-purpose data-binding package of the FasterXML Jackson suite. It provides full data-binding (object serialization and deserialization) on top of the Jackson streaming parser/generator (jackson-core) and the Jackson annotations (jackson-annotations), and is one of the most widely used JSON libraries for Java.

A resource injection vulnerability (CVE-2026-19032) has been identified in jackson-databind, which allows attackers who control a JSON string bound to a java.nio.file.Path value to select an arbitrary Java file-system provider by URI scheme. The library resolves the attacker's URI with no scheme restriction, forcing java.nio.file.spi.FileSystemProvider implementations to be loaded and handing the full attacker-supplied URI to whichever provider matches the scheme.

MITRE's CWE-610 describes the underlying weakness class as one where the product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

This issue affects multiple versions of jackson-databind: 2.x releases from 2.8.0 up to and including 2.18.9, from 2.19.0 up to and including 2.21.5, and from 2.22.0 up to and including 2.22.1, as well as 3.x releases prior to 3.1.6 and 3.2.x releases prior to 3.2.2.

Details

Module Info

• Product: jackson-databind
• Affected packages: com.fasterxml.jackson.core:jackson-databind (2.x), tools.jackson.core:jackson-databind (3.x)
• Affected versions:
• com.fasterxml.jackson.core:jackson-databind: >=2.8.0 <2.18.10, >=2.19.0 <2.21.6, >=2.22.0 <2.22.2
• tools.jackson.core:jackson-databind: >=3.0.0 <3.1.6, >=3.2.0 <3.2.2
• GitHub repository: https://github.com/FasterXML/jackson-databind
• Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-databind
• Package manager: Maven
• Fixed in:
  
  • NES for Jackson 2.13.10, 2.14.7, and 2.15.8
  • OSS 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2

Vulnerability Info

This Medium-severity vulnerability is found in the com.fasterxml.jackson.core:jackson-databind package in multiple 2.x and 3.x versions of jackson-databind. The default deserializer for java.nio.file.Path (NioPathDeserializer on the 2.x lines) converts any JSON string containing a : into a java.net.URI and resolves it through the JDK file-system provider machinery without restricting which URI schemes are acceptable:

final URI uri;
try {
    uri = new URI(value);
} catch (URISyntaxException e) {
    return (Path) ctxt.handleInstantiationProblem(handledType(), value, e);
}
try {
    return Paths.get(uri);
} catch (FileSystemNotFoundException cause) {
    try {
        final String scheme = uri.getScheme();
        // We want to use the current thread's context class loader, not system class loader that is used in Paths.get():
        for (FileSystemProvider provider : ServiceLoader.load(FileSystemProvider.class)) {
            if (provider.getScheme().equalsIgnoreCase(scheme)) {
                return provider.getPath(uri);
            }
        }
        return (Path) ctxt.handleInstantiationProblem(handledType(), value, cause);
    } catch (Throwable e) {
        e.addSuppressed(cause);
        return (Path) ctxt.handleInstantiationProblem(handledType(), value, e);
    }
}

Paths.get(uri) scans every FileSystemProvider installed in the JVM for one whose scheme matches the attacker's URI, and when none matches, the deserializer additionally scans providers registered on the thread context class loader through ServiceLoader. Because Path handling is wired into Jackson's standard deserializer factory, a stock new ObjectMapper() with no polymorphic typing, no registered modules, and no other configuration is exposed; the only precondition is that the application binds a java.nio.file.Path-typed value (a field, setter, or creator parameter, or a direct readValue(json, Path.class) call) from untrusted JSON.

With only the JDK's built-in providers the consequences are bounded: a jrt: URI resolves to a live Path into the runtime image, and other built-in schemes end in an exception inside readValue. The exposure grows with the classpath, however, since no allowlist exists anywhere on the code path: any third-party file-system provider present in the application, such as a cloud-storage, archive, or network file system, can be selected by the attacker, its classes loaded and initialized, and its resolution logic driven with the full attacker-controlled URI.

Mitigation

Only recent versions of Jackson are community-supported. The affected 2.13.x, 2.14.x, and 2.15.x lines are End-of-Life and will not receive public updates to address this issue. There is no publicly available fix for these lines; NES for Jackson is the remedy.

Users of the affected components should apply one of the following mitigations:

• Upgrade jackson-databind to a currently supported 2.x release that contains the fix, such as 2.18.10 or later.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• waydeshi (finder)