Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Apache Juneau may run attacker-chosen code during data parsing

CVE-2026-73098 · published 4 days ago
Summary

Apache Juneau versions up to 9.2.0 can load and initialize any class named in incoming data, which could trigger unwanted code execution depending on what classes are present. This risk arises when the library converts input into a Class type. Upgrading to version 9.2.1 resolves the issue.

What to do
  • Update apache software foundation apache juneau to version 9.2.1 or later.
Affected software
VendorProductAffected versions
apache software foundation apache juneau < 9.2.1
Original advisory text
Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing
Improper control of dynamically-loaded code vulnerability in Apache Juneau.

When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer. The impact depends on the classes present in the deployment.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Timeline
Published5 Nov 2026
Updated6 Nov 2026
First seen5 Nov 2026
Sources
CVE-2026-73098 · NVD
CVE-2026-73098 · MITRE
Track software like this
Free during beta