CVE-2026-71253
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in…
- Risk score
- 74/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.7%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Apache Johnzon has a 'Unsafe Reflection' vulnerability where an attacker-named class can be loaded and initialized from untrusted JSON. An attacker could use this to gain high privileges, read, write, or delete data, and potentially execute arbitrary code.
- Affected
- {'products': ['Apache Johnzon'], 'packages': [], 'versions': ['1.0.0 before 2.2.0']}
- Fix
- Upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace)
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
Last activity 19 Oct 2026. Patch Forecast updates every hour.