CVE-2026-19032: jackson-databind SSRF Vulnerability

CVE-2026-19032 Overview

CVE-2026-19032 affects jackson-databind, the widely deployed Java JSON binding library maintained by FasterXML. The deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. Untrusted JSON input can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper. The flaw is tracked as unsafe reflection [CWE-470].

Critical Impact
With only JDK built-in providers on the classpath, the resolved path is inert. If a side-effecting third-party FileSystemProvider is present, attacker-controlled JSON can force its class loading and invocation during deserialization.

Affected Products

com.fasterxml.jackson.core:jackson-databind 2.8.0 through 2.18.9, 2.19.0 through 2.21.5, and 2.22.0 through 2.22.1
tools.jackson.core:jackson-databind 3.0.0 through 3.1.5 and 3.2.0 through 3.2.1
Any Java application binding java.nio.file.Path from untrusted JSON using the default JsonMapper

Discovery Timeline

2026-09-01 - CVE-2026-19032 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-19032

Vulnerability Analysis

The vulnerability resides in JDKFromStringDeserializer.NioPathHelper.deserialize. A string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When Path.of(uri) throws FileSystemNotFoundException, the code falls back to enumerating ServiceLoader<FileSystemProvider> and invokes provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme.

This fallback path allows untrusted JSON to select and drive any registered FileSystemProvider during deserialization. It also forces class loading of that provider through the ServiceLoader mechanism.

With only JDK built-in providers (file, jar, zipfs) present, the resolved path is inert. No mount or network I/O occurs. Further impact requires a side-effecting third-party FileSystemProvider on the classpath whose getPath method performs sensitive operations.

Root Cause

The deserializer treats any URI scheme as acceptable input. It does not maintain an allowlist of safe schemes before invoking ServiceLoader on FileSystemProvider. This mirrors a broader class of unsafe reflection issues [CWE-470] where attacker-controlled input steers provider or class selection.

Attack Vector

An attacker sends JSON containing a URI value bound to a java.nio.file.Path field. The URI scheme is chosen to match a target FileSystemProvider registered via META-INF/services. When the default deserializer processes the value, it loads and invokes that provider. Exploitation requires no authentication or user interaction and occurs over the network wherever the application accepts JSON.

text

// Security patch reference (VERSION-2.x)
#6129: Limit the supported URL schemes for `java.nio.file.Path`
  deserialization [GHSA-wjgm-6hv5-3cvf]
 (reported by @waydeshi)
 (fix by @pjfanning)

Source: GitHub Commit cc6756b

Detection Methods for CVE-2026-19032

Indicators of Compromise

JSON payloads containing java.nio.file.Path fields with URI values using non-file schemes such as jar:, zip:, or custom third-party schemes
Unexpected class loading events referencing FileSystemProvider implementations during JSON deserialization
FileSystemNotFoundException traces followed by third-party provider invocations under ObjectMapper.readValue call stacks

Detection Strategies

Perform Software Composition Analysis (SCA) on Java build manifests to flag jackson-databind versions below 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2
Inspect application classpaths for META-INF/services/java.nio.file.spi.FileSystemProvider entries beyond the JDK defaults
Review data-binding models for fields typed as java.nio.file.Path that receive untrusted JSON input

Monitoring Recommendations

Log and alert on FileSystemProvider class loading initiated from JSON deserialization threads
Capture stack traces for FileSystemNotFoundException in application logs to identify probing attempts
Monitor outbound network and file I/O originating from JVM processes handling external JSON traffic

How to Mitigate CVE-2026-19032

Immediate Actions Required

Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 depending on your current branch
Audit application models and remove java.nio.file.Path fields bound directly from untrusted JSON
Remove or isolate third-party FileSystemProvider implementations that are not required at runtime

Patch Information

The fix in pull request #6129 restricts the URI schemes accepted by NioPathHelper.deserialize. Details are published in GHSA-wjgm-6hv5-3cvf. The patch was landed across the 2.x, 3.1, and 3.2 branches via commits cc6756b, ce26eda, and d94bb63.

Workarounds

Replace Path bindings with String fields and validate the value before constructing a Path in application code
Register a custom deserializer for java.nio.file.Path that enforces a strict scheme allowlist such as file
Constrain the classpath to remove non-essential FileSystemProvider implementations

bash

# Maven dependency pin example
mvn versions:use-dep-version \
  -Dincludes=com.fasterxml.jackson.core:jackson-databind \
  -DdepVersion=2.18.10 \
  -DforceVersion=true