Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in jackson-databind (CVE-2026-19032)

Summary IBM Db2 Developer Extension is affected by vulnerability in jackson-databind CVE-2026-19032 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

Amazon Linux 2023 : jackson-databind (ALAS2023-2026-3305)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3305 advisory. jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string...

Important: jackson-databind

Issue Overview: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throw...

Security Bulletin:Multiple vulnerabilities in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-19032, CVE-2026-83557)

Summary Multiple security vulnerabilities have been identified in jackson-databind, General data-binding functionality for Jackson. jackson-databind is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediati...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Unsafe Reflection and Deserialization of Untrusted Data in jackson-databind (CVE-2026-19032, CVE-2026-83557)

Summary IBM Watson Speech Services Cartridge is vulnerable to Unsafe Reflection and Deserialization of Untrusted Data in jackson-databind, due to issues with the DefaultBaseTypeLimitingValidator and deserializer for java.nio.file. Jackson-databind is used in our Speech microservices. These...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.1

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.1 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

Security Bulletin:Vulnerabilities exists in Jackson package used by IBM Netezza Appliance

Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch release of NPS Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the...

Medium: jackson-databind

Issue Overview: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throw...

Amazon Linux 2023 : jackson-databind (ALAS2023-2026-3208)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3208 advisory. jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in jackson-databind.jar in IBM Integration Designer: CVE-2026-19032 and CVE-2026-83557 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

Security Bulletin: Vulnerability jackson-databind, golang.org/x/mod, image-size, bcprov-jdk18on, bcpkix-jdk18on, pyasn, setuptools, Mako, paramiko, http2-common Oct 2026v1

Summary jackson-databind CVE-2026-19032, CVE-2026-83557,CVE-2026-19032, golang.org/x/mod CVE-2026-56864, CVE-2026-56865, image-size CLEVOS-111792, bcprov-jdk18on CVE-2026-12185, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860, CVE-2026-13506, CVE-2026-13586, CVE-2026-14682, CVE-2026-15055,...

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Summary A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URIvalue → Path.ofuri, then on FileSystemNotFoundException into a ServiceLoader enumeration that calls provider.getPathuri on the first...

GHSA-WJGM-6HV5-3CVF jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Summary A java.nio.file.Path field bound from untrusted JSON reaches JDKFromStringDeserializer.NioPathHelper.deserialize. The attacker string flows through new URIvalue → Path.ofuri, then on FileSystemNotFoundException into a ServiceLoader enumeration that calls provider.getPathuri on the first...

EUVD-2026-68961

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution...

Deserialization Of Untrusted Data

jackson-databind is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to insufficient restriction of attacker-controlled URI schemes when deserializing java.nio.file.Path, which allows an attacker to select and invoke a registered third-party FileSystemProvider and...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities (CVE-2026-19032, CVE-2026-83557)

Summary Multiple vulnerabilities are found in dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION:...

CVE-2026-19032

A flaw was found in jackson-databind. When deserializing java.nio.file.Path from untrusted JSON input, the deserializer resolves an attacker-supplied Uniform Resource Identifier URI without restricting the URI scheme. This allows a remote attacker to select and drive an arbitrary registered...

SUSE CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

Linux Distros Unpatched Vulnerability : CVE-2026-19032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' through NioPathDeserializer in src/main/java/com/fasterxml/jackson/databind/ext/NioPathDeserializer.java. An attacker can force readValue to resolve an...