VDB

RHSA-2026:83082

RHSA-2026:83082 PUBLISHED CVSS 6.5 MEDIUM

A flaw was found in jackson-databind. When deserializing java.nio.file.Path from untrusted JSON input, the deserializer resolves an attacker-supplied Uniform Resource Identifier (URI) without restricting the URI scheme. This allows a remote attacker to select and drive an arbitrary registered FileSystemProvider and force provider class loading. While the direct impact with only built-in Java Development Kit (JDK) providers is limited, the presence of a side-effecting third-party FileSystemProvider on the classpath could lead to further unintended consequences, such as resource access or network input/output (I/O).

Risk Scores

CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected Products

VendorProductVersions
Red Hatio.netty.netty-handler-proxy-4.1.138.Final-redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat4.1.138
Red Hatio.quarkus.quarkus-hibernate-validator-spi-3.27.6.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat3.27.6
Red Hatio.quarkus.quarkus-smallrye-openapi-common-deployment-3.27.6.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat3.27.6
Red Hatio.quarkus.quarkus-websockets-client-deployment-3.27.6.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat3.27.6
Red Hatorg.rnorth.duct-tape.duct-tape-1.0.8.jar as a component of Red Hat build of Quarkus 3.27.6.redhat1.0.8
Red Hatio.quarkus.quarkus-kafka-streams-deployment-3.27.6.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat3.27.6
Red Hatio.fabric8.kubernetes-model-coordination-7.3.1.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat7.3.1
Red Hatorg.testcontainers.mssqlserver-1.21.4.jar as a component of Red Hat build of Quarkus 3.27.6.redhat1.21.4
Red Hatcom.google.protobuf.protoc-3.25.5-linux-x86_64.exe as a component of Red Hat build of Quarkus 3.27.6.redhat3.25.5-linux
Red Hatio.quarkus.quarkus-kubernetes-client-3.27.6.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat3.27.6
Red Hatjavax.annotation.javax.annotation-api-1.3.2.redhat-00003.jar as a component of Red Hat build of Quarkus 3.27.6.redhat1.3.2
Red Hatio.smallrye.smallrye-fault-tolerance-mutiny-6.9.4.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat6.9.4
Red Hatorg.wildfly.security.wildfly-elytron-sasl-gs2-2.6.10.SP1-redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat2.6.10
Red Hatio.quarkus.quarkus-spring-data-jpa-deployment-3.27.6.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat3.27.6
Red Hatorg.antlr.antlr4-runtime-4.13.2.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat4.13.2
Red Hatio.quarkus.quarkus-vertx-latebound-mdc-provider-3.27.6.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat3.27.6
Red Hatio.smallrye.smallrye-graphql-schema-model-2.14.3.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat2.14.3
Red Hatio.quarkus.quarkus-observability-devservices-common-3.27.6.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat3.27.6
Red Hatio.smallrye.config.smallrye-config-validator-3.13.4.redhat-00001.jar as a component of Red Hat build of Quarkus 3.27.6.redhat3.13.4
Red Hatio.quarkus.quarkus-rest-common-deployment-3.27.6.redhat-00004.jar as a component of Red Hat build of Quarkus 3.27.6.redhat3.27.6

…and 1013 more

Timeline

  • Oct 15, 2026 CVE Published
  • Oct 21, 2026 CVE Updated
  • Oct 21, 2026 Distribution Patch
  • Oct 21, 2026 Distribution Patch
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory
  • Oct 21, 2026 Security Advisory

References

…and 188 more

Open in Interactive Console →
$ Console Community · 50/day Open console ›