CVE-2026-73098: Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing

Published Nov 4, 2026

Updated

Improper control of dynamically-loaded code vulnerability in Apache Juneau.

When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer. The impact depends on the classes present in the deployment.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Juneau to a version that resolves this vulnerability.
Fixed in 9.2.1

Event History

Nov 5, 2026

CVE Published

via MITRE·11:49 AM

Data Sourced

via MITRE·11:49 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using affected Apache Juneau versions through 9.2.0 are exposed when they parse attacker-controlled values into properties typed as java.lang.Class, including parameterized forms. The practical impact depends on which classes are available on the application's classpath.

What must an attacker provide to trigger the behavior?

An attacker needs to supply parsed input that names a class on the application classpath for a property of type java.lang.Class. Parsing that value can load the named class with initialization enabled and execute its static initializer.

Are applications protected if the relevant class is not present?

The described class-initialization behavior requires the attacker-named class to be present on the application classpath. The severity and resulting impact therefore depend on the classes included in the deployment.

What is the recommended remediation?

Upgrade Apache Juneau to version 9.2.1, which fixes the issue.

CVE-2026-73098: Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker provide to trigger the behavior?

Are applications protected if the relevant class is not present?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker provide to trigger the behavior?

Are applications protected if the relevant class is not present?

What is the recommended remediation?