Deserialization Vulnerability in Jackson Databind Affects FileSystemProvider Handling

CVE-2026-19032

What is CVE-2026-19032?

A vulnerability exists in Jackson Databind's deserialization of java.nio.file.Path, allowing untrusted JSON to resolve arbitrary URIs and potentially select a registered FileSystemProvider. When handling a URI from untrusted JSON, vulnerabilities permit the code to evaluate an attacker-controlled path, potentially applying side effects based on the FileSystemProvider class present in the application’s classpath. Risks increase when third-party FileSystemProviders with side effects are included. Users are recommended to upgrade to the latest versions to secure against this vulnerability and to avoid binding java.nio.file.Path from untrusted JSON entirely.

References