# CVE-2026-19032: FasterXML jackson-databind Path deserialization URI scheme injection

Source: https://junglewise.ai/threats/cve-2026-19032-fasterxml-jackson-databind-path-deserialization-uri-scheme  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19032 · Severity: medium · CVSS 5.3 · Published 2026-09-01

jackson-databind is a popular JSON parsing library for Java applications. A vulnerability in its handling of java.nio.file.Path deserialization allows attackers to supply JSON containing arbitrary URI schemes, which can trigger loading of attacker-selected FileSystemProvider implementations. This could enable code execution or system access if malicious or vulnerable third-party filesystem providers are available on the application's classpath, potentially compromising application availability and data security.

Technologies: [FasterXML Jackson Databind](https://junglewise.ai/threats/technologies/jackson-databind), [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind), [tools.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/tools-jackson-core-jackson-databind). Vendors: [FasterXML](https://junglewise.ai/threats/vendors/fasterxml), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-19032 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19032 being exploited in the wild.

**How severe is CVE-2026-19032?** Medium severity, with a CVSS score of 5.3, published 1 September 2026.

**Which products and versions are affected?** FasterXML Jackson Databind tools.jackson.core fork: 3.0.0 to <3.1.6, 3.2.0 to <3.2.2; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.8.0,fixed=2.18.10; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.6.

**Is there a fix for CVE-2026-19032?** Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.10 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19032 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19032?** Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.10 or later

  ```sh
  # set com.fasterxml.jackson.core:jackson-databind to 2.18.10 in your pom.xml or build.gradle
  ```

- tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.6 or later

  ```sh
  # set tools.jackson.core:jackson-databind to 3.1.6 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in JDKFromStringDeserializer.NioPathHelper.deserialize, which processes untrusted JSON strings representing file paths. When a URI fails to resolve with standard schemes, the code enumerates ServiceLoader-registered FileSystemProvider implementations and calls provider.getPath(uri) on the first matching the attacker-supplied scheme. This allows arbitrary provider instantiation and class loading without restricting URI schemes. The attack requires Path to be deserialized from untrusted JSON via JsonMapper.readValue(), but with only JDK built-in providers (file, jar/zipfs), impact is limited; exploitation requires a side-effecting third-party FileSystemProvider on the classpath. Patches are available in jackson-databind 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2.

## Affected products

- FasterXML jackson-databind 2.8.0 to <2.18.10, 2.19.0 to <2.21.6, 2.22.0 to <2.22.2, 3.0.0 to <3.1.6, 3.2.0 to <3.2.2
- FasterXML jackson-databind tools.jackson.core fork: 3.0.0 to <3.1.6, 3.2.0 to <3.2.2

## Identifiers

- CVE-2026-19032
- GHSA-wjgm-6hv5-3cvf

## Timeline

- 2026-09-01: disclosed
- 2026-08-06: patched: Patches committed to jackson-databind repository

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551](https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551)

## Related threats

- [jackson-databind type validation bypass in generic arguments](https://junglewise.ai/threats/cve-2026-110879-jackson-databind-validates-the-outer-class-of-a-class-name-type)
- [Jackson Protobuf Parser integer overflow in string key parsing](https://junglewise.ai/threats/cve-2026-110747-protobufparser-readstringkey-reads-the-length-prefix-of-a)
- [jackson-databind quadratic complexity in forward-reference resolution](https://junglewise.ai/threats/cve-2026-91777-jackson-databind-quadratic-forward-reference-completion)
- [FasterXML Jackson Databind unbounded cache growth on unknown type IDs](https://junglewise.ai/threats/cve-2026-91776-jackson-databind-retains-every-unknown-raw-type-id)
- [FasterXML jackson-databind quadratic parse in XML datatype deserialization](https://junglewise.ai/threats/cve-2026-68497-fasterxml-jackson-databind-quadratic-parse-in-xml-datatype)