CVE-2026-19032: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in FasterXML jackson-databind

The vulnerability occurs in jackson-databind's deserialization of java.nio.file.Path fields from JSON. The attacker controls a URI string that is parsed and passed to Path.of(uri), which attempts to resolve the URI scheme to a FileSystemProvider. If the built-in providers do not handle the scheme, the code enumerates all registered FileSystemProviders via ServiceLoader and calls getPath(uri) on the first provider matching the scheme. This allows an attacker to influence which provider is loaded and invoked during deserialization. The built-in providers like 'file' and 'jar' do not perform network I/O or mount filesystems, so the impact depends on any third-party FileSystemProvider registered in the environment. The vulnerability is due to lack of scheme restrictions and unsafe reflection-like behavior in provider selection during deserialization.

The impact is limited to potential side effects caused by invoking arbitrary FileSystemProviders during deserialization of attacker-controlled JSON input. Built-in providers do not perform network or mounting operations, so no direct remote code execution or data leakage is indicated. However, if a third-party FileSystemProvider is registered that performs side-effecting operations, an attacker could trigger those during deserialization. There is no indication of confidentiality or integrity compromise solely from this vulnerability. The vulnerability is categorized as medium severity with a CVSS score of 5.3, reflecting limited impact and network attack vector without privileges or user interaction.

No official patch links are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a mitigation, avoid binding java.nio.file.Path from untrusted JSON input, as this is an anti-pattern. Restrict or validate URI schemes before deserialization if possible. Monitor vendor advisories for updates or patches addressing this issue. Since the vulnerability depends on the presence of third-party FileSystemProviders, auditing and controlling installed providers can reduce risk.