Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in jackson-databind (CVE-2026-19032, CVE-2026-83557)

Summary IBM Db2 Developer Extension is affected by vulnerability in jackson-databind CVE-2026-19032, CVE-2026-83557 Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. ...

CVE-2026-19032: Use of Externally-Controlled Input to Select Classes or Code

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...