{"uuid": "ea97bfdd-cc02-4474-93df-d86c553cb3a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-19032", "type": "seen", "source": "https://gist.github.com/alon710/2e449fe44747cb62432125e3fb384a21", "content": "# CVE-2026-19032: CVE-2026-19032: Insecure Deserialization and Class Loading via java.nio.file.Path Resolution in FasterXML jackson-databind\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-19032\n\n## Summary\nAn insecure deserialization vulnerability exists in FasterXML jackson-databind due to improper validation of URI schemes when resolving java.nio.file.Path properties. When binding untrusted JSON input to a Path field, the deserializer resolves attacker-supplied URIs without restriction. If the scheme is unrecognized by the default filesystem, the application falls back to querying registered SPI FileSystemProvider instances, causing class loading and potential side effects in environments with custom providers.\n\n## TL;DR\nUnauthenticated remote attackers can trigger unsafe Java ServiceLoader class loading and execute arbitrary FileSystemProvider resolution logic by supplying crafted URIs in JSON properties deserialized as java.nio.file.Path fields.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-470, CWE-610\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00529 (0.529%)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n- **Impact**: Low (Unsafe Class Loading / Resource Querying / SSRF)\n\n## Affected Systems\n\n- Applications deploying com.fasterxml.jackson.core:jackson-databind between 2.8.0 and 2.18.9\n- Applications deploying com.fasterxml.jackson.core:jackson-databind between 2.19.0 and 2.21.5\n- Applications deploying com.fasterxml.jackson.core:jackson-databind between 2.22.0 and 2.22.1\n- Applications deploying tools.jackson.core:jackson-databind between 3.0.0 and 3.1.5\n- Applications deploying tools.jackson.core:jackson-databind between 3.2.0 and 3.2.1\n- **jackson-databind (2.x)**: >= 2.8.0, < 2.18.10 (Fixed in: `2.18.10`)\n- **jackson-databind (2.x)**: >= 2.19.0, < 2.21.6 (Fixed in: `2.21.6`)\n- **jackson-databind (2.x)**: >= 2.22.0, < 2.22.2 (Fixed in: `2.22.2`)\n- **jackson-databind (3.x)**: >= 3.0.0, < 3.1.6 (Fixed in: `3.1.6`)\n- **jackson-databind (3.x)**: >= 3.2.0, < 3.2.2 (Fixed in: `3.2.2`)\n\n## Mitigation\n\n- Upgrade jackson-databind to a patched version immediately.\n- Avoid binding untrusted JSON parameters directly to java.nio.file.Path fields.\n- Explicitly configure custom allowed URI schemes on a manually instantiated NioPathDeserializer if multi-filesystem support is mandatory.\n\n**Remediation Steps:**\n1. Identify all internal services and third-party applications importing com.fasterxml.jackson.core:jackson-databind or tools.jackson.core:jackson-databind.\n2. Update project dependencies (Maven pom.xml or Gradle build files) to use 2.18.10+, 2.21.6+, 2.22.2+, 3.1.6+, or 3.2.2+.\n3. Implement integration tests to verify that deserializing non-file URI schemes to Path fields now results in a WeirdStringValueException.\n\n## References\n\n- [FasterXML Security Advisory GHSA-wjgm-6hv5-3cvf](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-19032) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T09:30:30.000000Z"}