Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Apache Johnzon may run attacker‑controlled code from JSON

CVE-2026-71253 · published 21 days ago
Summary

Apache Johnzon can load and start a class named by an attacker when it processes JSON data from an untrusted source. This could let a malicious user execute unwanted code on your system. Upgrade to the latest released version (1.3.1 for the javax variant or 2.2.0 for the jakarta variant) to close the risk.

What to do
  • Update apache software foundation apache johnzon to version 2.2.0 or later.
Affected software
VendorProductAffected versions
apache software foundation apache johnzon < 2.2.0
Original advisory text
Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.



ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.




This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.



Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Timeline
Published19 Oct 2026
Updated4 Nov 2026
First seen19 Oct 2026
Sources
CVE-2026-71253 · NVD
CVE-2026-71253 · MITRE
CVE-2026-71253 · OSV
Track software like this
Free during beta