Live › vulnerability › CVE-2026-71253
Go to dashboardApache Johnzon, a Java JSON library, has an unsafe reflection flaw where its ClassConverter loads and static-initializes a class whose name comes from untrusted JSON. An attacker who can supply JSON to an application that parses it with Johnzon can trigger code execution through class static initializers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Find Apache Johnzon in the project dependencies (for example johnzon-core in pom.xml or build.gradle) and check the version.
Upgrade Apache Johnzon to 1.3.1 (javax namespace) or 2.2.0 (jakarta namespace), as the sources recommend.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.
ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.
This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.
Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-71253")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.