VDB

RHSA-2026:83520

RHSA-2026:83520 PUBLISHED CVSS 6.5 MEDIUM

Record from redhat · Published October 15, 2026

A flaw was found in jackson-databind. When deserializing java.nio.file.Path from untrusted JSON input, the deserializer resolves an attacker-supplied Uniform Resource Identifier (URI) without restricting the URI scheme. This allows a remote attacker to select and drive an arbitrary registered FileSystemProvider and force provider class loading. While the direct impact with only built-in Java Development Kit (JDK) providers is limited, the presence of a side-effecting third-party FileSystemProvider on the classpath could lead to further unintended consequences, such as resource access or network input/output (I/O).

Risk scores

CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

VendorProductVersions
Red Hatio.quarkus.quarkus-cyclonedx-generator-3.33.4.redhat-00004.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.33.4.redhat-00004.jar
Red Hatio.smallrye.config.smallrye-config-core-3.16.0.redhat-00001.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.16.0.redhat-00001.jar
Red Hatorg.codehaus.woodstox.stax2-api-4.2.2.redhat-00003.jar as a component of Red Hat build of Quarkus 3.33.4.redhat4.2.2.redhat-00003.jar
Red Hatorg.infinispan.infinispan-commons-16.0.15.redhat-00001.jar as a component of Red Hat build of Quarkus 3.33.4.redhat16.0.15.redhat-00001.jar
Red Hatcom.sun.xml.dtd-parser.dtd-parser-1.5.1.redhat-00001.jar as a component of Red Hat build of Quarkus 3.33.4.redhat1.5.1.redhat-00001.jar
Red Hatorg.wildfly.security.wildfly-elytron-x500-2.8.5.Final-redhat-00001.jar as a component of Red Hat build of Quarkus 3.33.4.redhat2.8.5.Final-redhat-00001.jar
Red Hatio.quarkus.quarkus-reactive-routes-deployment-3.33.4.redhat-00004.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.33.4.redhat-00004.jar
Red Hatorg.graalvm.sdk.nativeimage-25.0.3.0-1-redhat-00001.jar as a component of Red Hat build of Quarkus 3.33.4.redhat25.0.3.0-1-redhat-00001.jar
Red Hatio.quarkus.quarkus-spring-data-jpa-3.33.4.redhat-00004.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.33.4.redhat-00004.jar
Red Hatio.quarkus.quarkus-rest-jackson-common-deployment-3.33.4.redhat-00004.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.33.4.redhat-00004.jar
Red Hatio.quarkus.quarkus-rest-common-3.33.4.redhat-00004.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.33.4.redhat-00004.jar
Red Hatio.dekorate.kubernetes-annotations-4.1.9.redhat-00001-noapt.jar as a component of Red Hat build of Quarkus 3.33.4.redhat4.1.9.redhat-00001-noapt.jar
Red Hatio.quarkus.quarkus-jacoco-3.33.4.redhat-00004.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.33.4.redhat-00004.jar
Red Hatio.netty.netty-codec-haproxy-4.1.138.Final-redhat-00001.jar as a component of Red Hat build of Quarkus 3.33.4.redhat4.1.138.Final-redhat-00001.jar
Red Hatio.smallrye.reactive.mutiny-smallrye-context-propagation-3.1.1.redhat-00001.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.1.1.redhat-00001.jar
Red Hatio.quarkus.quarkus-rest-spi-deployment-3.33.4.redhat-00004.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.33.4.redhat-00004.jar
Red Hatio.quarkus.quarkus-security-jpa-common-deployment-3.33.4.redhat-00004.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.33.4.redhat-00004.jar
Red Hatcom.ongres.stringprep.stringprep-2.4.0.redhat-00001.jar as a component of Red Hat build of Quarkus 3.33.4.redhat2.4.0.redhat-00001.jar
Red Hatio.quarkus.quarkus-container-image-podman-deployment-3.33.4.redhat-00004.jar as a component of Red Hat build of Quarkus 3.33.4.redhat3.33.4.redhat-00004.jar
Red Hatio.prometheus.simpleclient_tracer_otel-0.16.0.redhat-00008.jar as a component of Red Hat build of Quarkus 3.33.4.redhat0.16.0.redhat-00008.jar

…and 1020 more

Timeline

  • Oct 15, 2026 CVE Published
  • Oct 21, 2026 CVE Updated
  • Oct 21, 2026 Distribution Patch (2 in total, the first dated here)
  • Oct 21, 2026 Security Advisory (22 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln RHSA-2026:83520
vulnetix vdb fixes RHSA-2026:83520

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A83520/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 175 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›