Skip to main content

jackson-databind CVE-2026-19032

| EUVDEUVD-2026-68961 MEDIUM
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (CWE-470)
2026-09-01 HeroDevs
Red Hat Suse Jackson Databind Fasterxml
5.3
CVSS 3.1 · Vendor: HeroDevs
Share

Severity by source

Vendor (HeroDevs) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
3.7 LOW

AC:H because meaningful availability impact requires third-party FileSystemProviders on the classpath, a non-default condition the description explicitly states.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (HeroDevs).

CVSS VectorVendor: HeroDevs

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

4
Metadata Corrected
Sep 01, 2026 - 04:40 vuln.today
tag: RCE removed
Source Code Evidence Fetched
Sep 01, 2026 - 04:24 vuln.today
Analysis Generated
Sep 01, 2026 - 04:24 vuln.today
CVE Published
Sep 01, 2026 - 03:18 cve.org
MEDIUM 5.3

DescriptionCVE.org

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

AnalysisAI

jackson-databind's NioPathDeserializer passes attacker-controlled URI strings from untrusted JSON through an unrestricted URI scheme resolution pipeline, allowing selection and invocation of arbitrary registered FileSystemProvider implementations at deserialization time. Affected versions span com.fasterxml.jackson.core:jackson-databind 2.8.0 through the pre-2.18.10/2.21.6/2.22.2 ranges and tools.jackson.core:jackson-databind 3.0.0 through the pre-3.1.6/3.2.2 ranges. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The application must deserialize JSON into a Java model class containing a java.nio.file.Path field (or a field mapped to Path via custom type mapping) using an unpatched version of jackson-databind under a default JsonMapper configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects straightforward network exploitability with no authentication barrier - any application deserializing java.nio.file.Path from untrusted JSON over a network endpoint is theoretically reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to one of the patched releases: com.fasterxml.jackson.core:jackson-databind 2.18.10, 2.21.6, or 2.22.2 for the 2.x lineage, or tools.jackson.core:jackson-databind 3.1.6 or 3.2.2 for the 3.x lineage, as documented at https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jackson Databind

View all
CVE-2020-11113 HIGH
8.8 Mar 31

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9548 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35728 HIGH
8.1 Dec 27

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35491 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9547 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35490 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-36183 HIGH POC
8.1 Jan 07

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2022-42004 HIGH POC
7.5 Oct 02

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeseriali
CVE-2022-42003 HIGH POC
7.5 Oct 02

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of
CVE-2019-12086 HIGH POC
7.5 May 17

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. Rated high severity (CVSS 7.5)
CVE-2020-25649 HIGH
7.5 Dec 03

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
CVE-2026-59889 MEDIUM POC
6.5 Jul 14

jackson-databind's @JsonView authorization guard is bypassable on deserialization when a property carries both @JsonView

Same weakness CWE-470 – Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

View all
CVE-2026-82078 CRITICAL POC
9.4
CVE-2024-0200 CRITICAL POC
9.8
CVE-2024-4990 CRITICAL POC
9.1
CVE-2024-28121 HIGH POC
8.8
CVE-2023-33652 HIGH POC
8.8
CVE-2026-58659 HIGH POC
8.4
CVE-2022-30287 HIGH POC
8.0
CVE-2025-68455 HIGH POC
7.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

Share

CVE-2026-19032 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy