CVE-2026-71253

CriticalCVSS 9.8

Published: 19/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

Apache Johnzon is affected by an Unsafe Reflection vulnerability — ClassConverter loads and static-initializes an attacker-named class from untrusted JSON. The issue affects versions from 1.0.0 before 2.2.0.

Risk Assessment

An attacker could force the loading and initialization of an arbitrary class, potentially leading to code execution or unexpected side effects. The risk applies to applications processing untrusted JSON with Johnzon.

Recommendation

Upgrade Apache Johnzon to version 1.3.1 (javax namespace) or 2.2.0 (jakarta namespace). Avoid processing untrusted JSON without appropriate restrictions.

Other vulnerabilities in Apache Johnzon

CVE-2023-33008Medium
A vulnerability in Apache Johnzon related to the deserialization of untrusted data allows an attacker to input large numbers in JSON format, potentially leading to slow conversion and Denial of Service risk.

Original NVD description (English source)

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS