{"id":"CVE-2026-73098","kind":"vulnerability","aliases":["CVE-2026-73098"],"related":[],"title":"Apache Juneau: parsing a Class value runs attacker-named static initializers","description":"Improper control of dynamically-loaded code vulnerability in Apache Juneau.\n\nWhen Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer. The impact depends on the classes present in the deployment.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue.","summary":"Apache Juneau loads any class named in parsed input with initialization enabled, so a class's static initializer runs. An attacker who can supply input that names a class on the application classpath can trigger code execution, and the impact depends on which classes the deployment contains.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-juneau","java","jvm","package"],"not_affected_if":["juneau-9.2.1-or-later","no-untrusted-class-input"],"how_to_check":"- Check the Apache Juneau version in the project's build file (Maven or Gradle dependency for org.apache.juneau).\n- Look for Juneau parsing of untrusted input into java.lang.Class properties.","fix":"- Apache Juneau: upgrade to `9.2.1`.","status":"open","published_at":"2026-11-05T12:17:50+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","triaged_at":"2026-11-05T12:40:06+00:00","updated_at":"2026-11-05T12:40:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T12:40:06Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Juneau: upgrade to `9.2.1`.","reach":"unknown","title":"Apache Juneau: parsing a Class value runs attacker-named static initializers","impact":"high","summary":"Apache Juneau loads any class named in parsed input with initialization enabled, so a class's static initializer runs. An attacker who can supply input that names a class on the application classpath can trigger code execution, and the impact depends on which classes the deployment contains.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-juneau","jvm"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker-chosen classes run static initializers, potentially executing code on the server","analyst_note":"Confirm whether the default class swap is reachable over HTTP in common Juneau REST setups and what classes typically exist on classpaths.","how_to_check":"- Check the Apache Juneau version in the project's build file (Maven or Gradle dependency for org.apache.juneau).\n- Look for Juneau parsing of untrusted input into java.lang.Class properties.","plain_action":"","needs_analyst":true,"not_affected_if":["juneau-9.2.1-or-later","no-untrusted-class-input"],"who_is_affected":"Applications that use Apache Juneau versions through 9.2.0 to parse untrusted input into java.lang.Class properties, including parameterized forms. Exposure depends on which classes are on the application classpath. Systems that do not parse external input into Class-typed properties are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000718,"input_tokens":4285,"output_tokens":578,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-73098':15A,18A '9.2.0':140C '9.2.1':148C 'affect':136C 'apach':1A,20B,25B,81C,84C,137C 'apache-juneau':19B 'applic':56B,116C 'attack':9A,45B 'attacker-nam':8A 'class':5A,29B,39B,53B,68B,100C,105C,113C,120C,129C 'classpath':57B,117C 'code':60B,78C 'contain':71B 'control':73C 'cve':13A,16A 'default':99C 'depend':65B,126C 'deploy':70B,133C 'dynam':76C 'dynamically-load':75C 'enabl':36B,108C 'execut':61B 'fix':150C 'form':97C 'impact':64B,125C 'improp':72C 'includ':95C 'initi':12A,35B,42B,107C,123C 'input':33B,49B,110C 'issu':135C,152C 'java':22B 'java.lang.class':94C 'juneau':2A,21B,26B,82C,85C,138C 'jvm':23B 'load':27B,77C,102C 'name':10A,30B,51B,104C,111C 'packag':24B 'parameter':96C 'pars':3A,32B,86C 'present':130C 'properti':91C 'ran':118C 'recommend':143C 'run':7A,43B 'static':11A,41B,122C 'suppli':48B 'swap':101C 'trigger':59B 'type':93C 'upgrad':145C 'user':141C 'valu':6A,88C 'version':147C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Apache Juneau versions through 9.2.0 to parse untrusted input into java.lang.Class properties, including parameterized forms. Exposure depends on which classes are on the application classpath. Systems that do not parse external input into Class-typed properties are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejuneau","critical","java","jvm","package"],"campaign_type":null,"first_public_at":"2026-11-05T12:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73098","severity":null,"published_at":"2026-11-05T12:17:50+00:00","modified_at":"2026-11-05T12:17:50+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","fetched_at":"2026-11-05T12:38:47+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}