CVE-2026-71253

9.8 Critique

Publiée le 19/10/2026 à 13:17 · Modifiée le 20/10/2026 à 22:17 · Analyse NVD reportée · Source : security@apache.org

Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Johnzon

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-470

Références

https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6
https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30
https://lists.apache.org/thread.html/3vgm1yo2sn9yhkvvs9lc4ro01vl3zt68

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories