CVE-2026-71253

UNKNOWN 0.0

Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.

CWE	CWE-470
Vendor	apache software foundation
Product	apache johnzon
Published	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache johnzon

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache johnzon are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Johnzon

2.0.0 < 2.2.0 1.0.0 < 1.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30 github.com: https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6 lists.apache.org: https://lists.apache.org/thread.html/3vgm1yo2sn9yhkvvs9lc4ro01vl3zt68

Credits

n0mi1k Security