CVE-2026-71253 Details
Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
A vulnerability allowing unsafe reflection has been identified in Apache Johnzon versions 1.0.0 prior to 2.2.0. The issue arises in the ClassConverter component, which loads and statically initializes classes based on names provided in untrusted JSON. This vulnerability could be exploited if an attacker can craft JSON that includes a class name of their choosing, potentially leading to the execution of malicious code if the specified class has a harmful initializer. Exploitation requires the presence of a class with a 'poisonous' initializer on the classpath and a REST POJO with a Class attribute in the project.
Users are advised to upgrade to Apache Johnzon version 1.3.1 (for the javax namespace) or version 2.2.0 (for the jakarta specification namespace), both of which address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6 | [email protected] | Source CodeVendor |
| https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30 | [email protected] | BundleSource CodeVendor |
| https://lists.apache.org/thread.html/3vgm1yo2sn9yhkvvs9lc4ro01vl3zt68 | [email protected] | Mailing ListTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Johnzon | >= 1.0.0, < 2.2.0 (semver) >= 2.0.0, < 2.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |