Improper Control of Dynamically-Loaded Code Vulnerability in Apache Juneau
CVE-2026-73098

10CRITICAL

Key Information:

Vendor

Apache
Status
Apache Juneau
Vendor
CVE Published:
5 November 2026

What is CVE-2026-73098?

The vulnerability in Apache Juneau arises from improper controls when dynamically loading code. Specifically, when parsing a value into a property of type java.lang.Class, the mechanism in place allows for the invocation of a class's static initializer from the application classpath. This occurs due to a default class swap that initiates class loading with initialized settings. The security implications can vary based on the specific classes deployed within the application environment. To mitigate risks, users are strongly advised to upgrade to version 9.2.1, which addresses this vulnerability.

Affected Version(s)

Apache Juneau 0 < 9.2.1

References

https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzc...
vendor-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.