Executive brief
jackson-databind is a popular JSON parsing library for Java applications. A vulnerability in its handling of java.nio.file.Path deserialization allows attackers to supply JSON containing arbitrary URI schemes, which can trigger loading of attacker-selected FileSystemProvider implementations. This could enable code execution or system access if malicious or vulnerable third-party filesystem providers are available on the application's classpath, potentially compromising application availability and data security.
Technical details
The vulnerability exists in JDKFromStringDeserializer.NioPathHelper.deserialize, which processes untrusted JSON strings representing file paths. When a URI fails to resolve with standard schemes, the code enumerates ServiceLoader-registered FileSystemProvider implementations and calls provider.getPath(uri) on the first matching the attacker-supplied scheme. This allows arbitrary provider instantiation and class loading without restricting URI schemes. The attack requires Path to be deserialized from untrusted JSON via JsonMapper.readValue(), but with only JDK built-in providers (file, jar/zipfs), impact is limited; exploitation requires a side-effecting third-party FileSystemProvider on the classpath. Patches are available in jackson-databind 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2.
Affected products
- FasterXML jackson-databind 2.8.0 to <2.18.10, 2.19.0 to <2.21.6, 2.22.0 to <2.22.2, 3.0.0 to <3.1.6, 3.2.0 to <3.2.2
- FasterXML jackson-databind tools.jackson.core fork: 3.0.0 to <3.1.6, 3.2.0 to <3.2.2
Timeline
- 2026-09-01: disclosed
- 2026-08-06: patched: Patches committed to jackson-databind repository