CVE-2026-73098 · Package
NO FIX YET · SEE WHAT TO DO
Apache Juneau loads any class named in parsed input with initialization enabled, so a class's static initializer runs. An attacker who can supply input that names a class on the application classpath can trigger code execution, and the impact depends on which classes the deployment contains.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use Apache Juneau versions through 9.2.0 to parse untrusted input into java.lang.Class properties, including parameterized forms. Exposure depends on which classes are on the application classpath. Systems that do not parse external input into Class-typed properties are less exposed.
Not affected if juneau-9.2.1-or-later, no-untrusted-class-input
Who cares apache-juneau, java, jvm
9.2.1.Improper control of dynamically-loaded code vulnerability in Apache Juneau.
When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer. The impact depends on the classes present in the deployment.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.