{"id":"CVE-2026-71253","kind":"vulnerability","aliases":["CVE-2026-71253"],"related":[],"title":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon","description":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.\n\n\n\nClassConverter loads & static-initializes an attacker-named class from untrusted JSON.\n\n\n\n\nThis issue affects Apache Johnzon: from 1.0.0 before 2.2.0.\n\n\n\nUsers are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.","summary":"Apache Johnzon, a Java JSON library, has an unsafe reflection flaw where its ClassConverter loads and static-initializes a class whose name comes from untrusted JSON. An attacker who can supply JSON to an application that parses it with Johnzon can trigger code execution through class static initializers.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-johnzon","java","json-parsing","package"],"not_affected_if":["affected-version-not-present","not-using-johnzon"],"how_to_check":"Find Apache Johnzon in the project dependencies (for example johnzon-core in pom.xml or build.gradle) and check the version.","fix":"Upgrade Apache Johnzon to 1.3.1 (javax namespace) or 2.2.0 (jakarta namespace), as the sources recommend.","status":"open","published_at":"2026-10-19T11:17:18+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-23T22:04:44+00:00","updated_at":"2026-10-23T22:28:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:04:44Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Johnzon to 1.3.1 (javax namespace) or 2.2.0 (jakarta namespace), as the sources recommend.\nunknown","reach":"unknown","impact":"high","summary":"Apache Johnzon, a Java JSON library, has an unsafe reflection flaw where its ClassConverter loads and static-initializes a class whose name comes from untrusted JSON. An attacker who can supply JSON to an application that parses it with Johnzon can trigger code execution through class static initializers.","category":"package","who_cares":["java","apache-johnzon","json-parsing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-chosen classes load and run static initializers on the server","analyst_note":"Check the Apache Johnzon security advisory for CVE-2026-71253 to confirm whether ClassConverter is reached by default parsing and what an attacker can trigger beyond static initializers.","how_to_check":"Find Apache Johnzon in the project dependencies (for example johnzon-core in pom.xml or build.gradle) and check the version.\nunknown","needs_analyst":true,"not_affected_if":["not-using-johnzon","affected-version-not-present"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000514,"input_tokens":2829,"output_tokens":463,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,22A '-71253':20A,23A '1.0.0':117C '1.3.1':127C '2.2.0':119C,131C 'affect':113C 'apach':16A,25B,32B,96C,114C 'apache-johnzon':24B 'applic':67B 'attack':60B,105C 'attacker-nam':104C 'class':9A,52B,78B,89C,107C 'classconvert':45B,98C 'code':11A,75B,91C 'come':55B 'control':5A,85C 'cve':18A,21A 'execut':76B 'extern':4A,84C 'externally-control':3A,83C 'fix':136C 'flaw':42B 'initi':50B,80B,102C 'input':6A,86C 'issu':112C,138C 'jakarta':132C 'java':27B,35B 'javax':128C 'johnzon':17A,26B,33B,72B,97C,115C 'json':29B,36B,58B,64B,110C 'json-pars':28B 'librari':37B 'load':46B,99C 'name':54B,106C 'namespac':129C,134C 'packag':31B 'pars':30B,69B 'recommend':122C 'reflect':13A,41B,93C 'select':8A,88C 'specif':133C 'static':49B,79B,101C 'static-initi':48B,100C 'suppli':63B 'trigger':74B 'unsaf':12A,40B,92C 'untrust':57B,109C 'upgrad':124C 'use':1A,81C 'user':120C 'version':126C 'vulner':14A,94C 'whose':53B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T11:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71253","severity":null,"published_at":"2026-10-19T11:17:18+00:00","modified_at":"2026-10-20T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}