CVE-2026-71253criticalCWE-470

CVE-2026-71253: critical vulnerability in Apache Johnzon

Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON

Published · Updated

Follow this CVE+ Monitor Apache Johnzon

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.4%
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Johnzon
Related CVEs — Apache Johnzon

In the same product, most dangerous first.

CVE-2023-33008MEDIUMApache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scaleEPSS 1.4%