CVE-2026-71253
Received Received - Intake

Unsafe Reflection in Apache Johnzon

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-71253
EUVD
EUVD-2026-104193

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Johnzon 2.0.0
Apache Software Foundation Apache Johnzon 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Apache Johnzon improperly handling untrusted JSON input. An attacker can provide a class name in JSON that Johnzon will attempt to load and initialize statically. This is known as 'Unsafe Reflection' where externally controlled input selects classes or code to execute.

Detection Guidance

To detect this vulnerability, check if your Apache Johnzon version is between 1.0.0 and 2.2.0. Run commands like 'mvn dependency:tree | grep johnzon' in Maven projects or inspect dependency files for affected versions. If using Jakarta namespace, check for versions before 2.2.0.

Impact Analysis

An attacker could exploit this to execute arbitrary code on systems using vulnerable versions of Apache Johnzon. This could lead to data breaches, system compromise, or unauthorized access depending on the application's context and permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations must address it to maintain compliance.

Mitigation Strategies

Upgrade Apache Johnzon to version 1.3.1 (javax namespace) or 2.2.0 (jakarta namespace) immediately. Remove any untrusted JSON input handling in ClassConverter or implement strict input validation to prevent class loading from external sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart