CVE-2026-71253

EUVD-2026-104193
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.



ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.




This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.



Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
Unsafe Reflection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 50.64%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apachejohnzon
2.0.0 ≤
𝑥
< 2.2.0
CNA
apachejohnzon
1.0.0 ≤
𝑥
< 1.3.1
CNA
Common Weakness Enumeration
References
https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6
https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30
https://lists.apache.org/thread.html/3vgm1yo2sn9yhkvvs9lc4ro01vl3zt68