Threat level Severe
Contact
Critical 9.8
CVE-2026-71253

Apache Apache Johnzon — Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability…

ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.

WeaknessCWE-470
Published Updated Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
0.4%
Higher than 31% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.

ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.

This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.

Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.

What to do

  1. 01Check whether you run Apache Johnzon, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD
  2. NVD record updated

Also actively exploited

CVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-1146259.9Arista VeloCloud OrchestratorCVE-2026-1114979.8Google Brotli
Vendor
Apache44 CVEs in 30 days
All Apache CVEs

Other CVEs from Apache

40+ more CVEs

All Apache CVEs
9.8Apache MINA — unsafe deserialization.EPSS 0.6%10.0Apache Traffic Server — incorrect authorization.EPSS 0.4%10.0Apache Traffic Server — improper certificate validation.EPSS 0.2%10.0Apache Traffic Server — improper certificate validation.EPSS 0.2%9.3Apache Apache Traffic Server — Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or…EPSS 0.2%9.0Apache Traffic Server — missing authentication.EPSS 0.4%