CVE-2026-71253: Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.
ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.
This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.
Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Johnzon (javax namespace)to a version that resolves this vulnerability.Fixed in 1.3.1 - Upgrade
Upgrade
Apache Johnzon (jakarta specification namespace)to a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Frequently Asked Questions
Which Apache Johnzon versions need remediation?
The issue affects Apache Johnzon versions from 1.0.0 before 2.2.0. Upgrade to 1.3.1 for the javax namespace or 2.2.0 for the jakarta specification namespace.
What attacker-controlled condition is required for exploitation?
An attacker must be able to supply untrusted JSON that reaches ClassConverter. The vulnerable behavior loads and static-initializes a class named through that JSON input.