cve-2026-19032
csaf_suse
Description
SUSE CVE-2026-19032
Timeline
- Published
- 2026-09-02 01:07 UTC
- Last Modified
- 2026-09-02
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "SUSE CVE-2026-19032",
"title": "Title"
},
{
"category": "description",
"text": "jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.",
"title": "Description of the CVE"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "CVE-2026-19032",
"url": "https://www.suse.com/security/cve/CVE-2026-19032"
},
{
"category": "external",
"summary": "SUSE Security Ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "external",
"summary": "SUSE Bug 1277883 for CVE-2026-19032",
"url": "https://bugzilla.suse.com/1277883"
}
],
"title": "SUSE CVE CVE-2026-19032",
"tracking": {
"current_release_date": "2026-09-02T01:07:18Z",
"generator": {
"date": "2026-09-02T01:07:18Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf-vex.pl",
"version": "1"
}
},
"id": "CVE-2026-19032",
"initial_release_date": "2026-09-02T01:07:18Z",
"revision_history": [
{
"date": "2026-09-02T01:07:18Z",
"number": "2",
"summary": "vulnerabilities added,references added,severity changed from to moderate"
}
],
"status": "interim",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Desktop 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Desktop 15 SP7",
"product_id": "SUSE Linux Enterprise Desktop 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sled:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP2",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP2",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP3",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP3",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP2",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP2",
"product_id": "SUSE Linux Enterprise Server 15 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP3",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP3",
"product_id": "SUSE Linux Enterprise Server 15 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4",
"product_id": "SUSE Linux Enterprise Server 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5",
"product_id": "SUSE Linux Enterprise Server 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6",
"product_id": "SUSE Linux Enterprise Server 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP7",
"product_id": "SUSE Linux Enterprise Server 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.1",
"product": {
"name": "SUSE Linux Enterprise Server 16.1",
"product_id": "SUSE Linux Enterprise Server 16.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.1:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server Teradata 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server Teradata 15 SP4",
"product_id": "SUSE Linux Enterprise Server Teradata 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_teradata:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.1",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.1",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.1:server-sap"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
},
{
"category": "product_version",
"name": "jackson-databind",
"product": {
"name": "jackson-databind",
"product_id": "jackson-databind",
"product_identification_helper": {
"cpe": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/jackson-databind@?upstream=jackson-databind.src.rpm"
}
}
},
{
"category": "product_version",
"name": "jackson-databind-javadoc",
"product": {
"name": "jackson-databind-javadoc",
"product_id": "jackson-databind-javadoc",
"product_identification_helper": {
"cpe": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/jackson-databind-javadoc@?upstream=jackson-databind.src.rpm"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP7",
"product_id": "SUSE Linux Enterprise Server 15 SP7:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Desktop 15 SP7",
"product_id": "SUSE Linux Enterprise Desktop 15 SP7:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server for SAP Applications 15 SP7",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP7:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP2",
"product_id": "SUSE Linux Enterprise Server 15 SP2:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server for SAP Applications 15 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise High Performance Computing 15 SP2",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP2:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP3",
"product_id": "SUSE Linux Enterprise Server 15 SP3:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind-javadoc as component of SUSE Linux Enterprise Server 15 SP3",
"product_id": "SUSE Linux Enterprise Server 15 SP3:jackson-databind-javadoc"
},
"product_reference": "jackson-databind-javadoc",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind-javadoc as component of SUSE Linux Enterprise Server for SAP Applications 15 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP3:jackson-databind-javadoc"
},
"product_reference": "jackson-databind-javadoc",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise High Performance Computing 15 SP3",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind-javadoc as component of SUSE Linux Enterprise High Performance Computing 15 SP3",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP3:jackson-databind-javadoc"
},
"product_reference": "jackson-databind-javadoc",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind-javadoc as component of SUSE Linux Enterprise Server 15 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP3-LTSS:jackson-databind-javadoc"
},
"product_reference": "jackson-databind-javadoc",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP4",
"product_id": "SUSE Linux Enterprise Server 15 SP4:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise High Performance Computing 15 SP4",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP5",
"product_id": "SUSE Linux Enterprise Server 15 SP5:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise High Performance Computing 15 SP5",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP6",
"product_id": "SUSE Linux Enterprise Server 15 SP6:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind-javadoc as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:jackson-databind-javadoc"
},
"product_reference": "jackson-databind-javadoc",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server 16.1",
"product_id": "SUSE Linux Enterprise Server 16.1:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind-javadoc as component of SUSE Linux Enterprise Server 16.1",
"product_id": "SUSE Linux Enterprise Server 16.1:jackson-databind-javadoc"
},
"product_reference": "jackson-databind-javadoc",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server Teradata 15 SP4",
"product_id": "SUSE Linux Enterprise Server Teradata 15 SP4:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server Teradata 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind-javadoc as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:jackson-databind-javadoc"
},
"product_reference": "jackson-databind-javadoc",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of SUSE Linux Enterprise Server for SAP applications 16.1",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.1:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind-javadoc as component of SUSE Linux Enterprise Server for SAP applications 16.1",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.1:jackson-databind-javadoc"
},
"product_reference": "jackson-databind-javadoc",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jackson-databind as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:jackson-databind"
},
"product_reference": "jackson-databind",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-19032",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-19032"
}
],
"notes": [
{
"category": "general",
"text": "jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.",
"title": "CVE description"
}
],
"product_status": {
"known_affected": [
"SUSE Linux Enterprise Desktop 15 SP7:jackson-databind",
"SUSE Linux Enterprise High Performance Computing 15 SP2:jackson-databind",
"SUSE Linux Enterprise High Performance Computing 15 SP3:jackson-databind",
"SUSE Linux Enterprise High Performance Computing 15 SP3:jackson-databind-javadoc",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:jackson-databind",
"SUSE Linux Enterprise High Performance Computing 15 SP4:jackson-databind",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:jackson-databind",
"SUSE Linux Enterprise High Performance Computing 15 SP5:jackson-databind",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:jackson-databind",
"SUSE Linux Enterprise Server 15 SP2-LTSS:jackson-databind",
"SUSE Linux Enterprise Server 15 SP2:jackson-databind",
"SUSE Linux Enterprise Server 15 SP3-LTSS:jackson-databind",
"SUSE Linux Enterprise Server 15 SP3-LTSS:jackson-databind-javadoc",
"SUSE Linux Enterprise Server 15 SP3:jackson-databind",
"SUSE Linux Enterprise Server 15 SP3:jackson-databind-javadoc",
"SUSE Linux Enterprise Server 15 SP4-LTSS:jackson-databind",
"SUSE Linux Enterprise Server 15 SP4:jackson-databind",
"SUSE Linux Enterprise Server 15 SP5-LTSS:jackson-databind",
"SUSE Linux Enterprise Server 15 SP5:jackson-databind",
"SUSE Linux Enterprise Server 15 SP6-LTSS:jackson-databind",
"SUSE Linux Enterprise Server 15 SP6:jackson-databind",
"SUSE Linux Enterprise Server 15 SP7:jackson-databind",
"SUSE Linux Enterprise Server 16.0:jackson-databind",
"SUSE Linux Enterprise Server 16.0:jackson-databind-javadoc",
"SUSE Linux Enterprise Server 16.1:jackson-databind",
"SUSE Linux Enterprise Server 16.1:jackson-databind-javadoc",
"SUSE Linux Enterprise Server Teradata 15 SP4:jackson-databind",
"SUSE Linux Enterprise Server for SAP Applications 15 SP2:jackson-databind",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:jackson-databind",
"SUSE Linux Enterprise Server for SAP Applications 15 SP3:jackson-databind-javadoc",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:jackson-databind",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:jackson-databind",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:jackson-databind",
"SUSE Linux Enterprise Server for SAP Applications 15 SP7:jackson-databind",
"SUSE Linux Enterprise Server for SAP applications 16.0:jackson-databind",
"SUSE Linux Enterprise Server for SAP applications 16.0:jackson-databind-javadoc",
"SUSE Linux Enterprise Server for SAP applications 16.1:jackson-databind",
"SUSE Linux Enterprise Server for SAP applications 16.1:jackson-databind-javadoc",
"openSUSE Leap 16.0:jackson-databind"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-19032",
"url": "https://www.suse.com/security/cve/CVE-2026-19032"
},
{
"category": "external",
"summary": "SUSE Security Ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "external",
"summary": "SUSE Bug 1277883 for CVE-2026-19032",
"url": "https://bugzilla.suse.com/1277883"
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-01T06:00:31Z",
"details": "moderate"
}
],
"title": "CVE-2026-19032"
}
]
}