Unsafe Reflection Vulnerability in Apache Johnzon
CVE-2026-71253

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Johnzon
Vendor
CVE Published:
19 October 2026

What is CVE-2026-71253?

A vulnerability exists in Apache Johnzon where the ClassConverter can load and initialize a class specified by an attacker from untrusted JSON input. This can potentially lead to unauthorized code execution due to the unsanitized handling of input. Users are strongly advised to upgrade to Apache Johnzon version 1.3.1 for javax namespace or version 2.2.0 for jakarta specification namespace, which addresses this issue.

Affected Version(s)

Apache Johnzon 2.0.0 < 2.2.0

Apache Johnzon 1.0.0 < 1.3.1

References

https://github.com/apache/johnzon/commit/dd3d00634c746a21...
patch
https://github.com/apache/johnzon/commit/91e7b0d21d08d138...
patch
https://lists.apache.org/thread.html/3vgm1yo2sn9yhkvvs9lc...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

n0mi1k Security
.