{
  "from_raw": "Markus Jung <jungm@apache.org>",
  "from": "Markus Jung <ju...@apache.org>",
  "gravatar": "33f594db3a0d178730328f34a346c70a",
  "to": "an...@apache.org,\n de...@johnzon.apache.org",
  "subject": "CVE-2026-71253: Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON",
  "message-id": "<895993ea-fb32-7b9d-5ba7-1394f151bf18@apache.org>",
  "mid": "3vgm1yo2sn9yhkvvs9lc4ro01vl3zt68",
  "permalinks": [
    "3vgm1yo2sn9yhkvvs9lc4ro01vl3zt68",
    "rcf2e650ffb2668b5a71d7f4253cece7129700f1b74c23c17ee277a18@<dev.johnzon.apache.org>"
  ],
  "dbid": "078c2c232da6adbcf6d7815fa6465b283f3a2fb208ae2493a108397efdd43c51",
  "cc": "",
  "epoch": 1792162603,
  "list": "<dev.johnzon.apache.org>",
  "list_raw": "<dev.johnzon.apache.org>",
  "date": "2026/10/16 14:56:43",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: severity: LOW. Although a class initialiser can be triggered remotely it needs 2 separate preconditions: a) there must be a poisonous class-initialiser on the classpath (unlikely). b) there must be a REST POJO with a Class attribute on the project (unlikely as well) \n\nAffected versions:\n\n- Apache Johnzon (org.apache.johnzon:johnzon-mapper) 2.0.0 before 2.2.0\n- Apache Johnzon (org.apache.johnzon:johnzon-mapper) 1.0.0 before 1.3.1\n\nDescription:\n\nUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.\n\n\n\nClassConverter loads & static-initializes an attacker-named class from untrusted JSON.\n\n\n\n\nThis issue affects Apache Johnzon: from 1.0.0 before 2.2.0.\n\n\n\nUsers are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.\n\nCredit:\n\nn0mi1k Security (finder)\n\nReferences:\n\nhttps://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30\nhttps://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6\nhttps://johnzon.apache.org/\nhttps://www.cve.org/CVERecord?id=CVE-2026-71253\n\n",
  "body_short": "Severity: severity: LOW. Although a class initialiser can be triggered remotely it needs 2 separate preconditions: a) there must be a poisonous class-initialiser on the classpath (unlikely). b) there m",
  "html_source_only": false,
  "attachments": [],
  "forum": "dev@johnzon.apache.org",
  "size": 4378,
  "id": "3vgm1yo2sn9yhkvvs9lc4ro01vl3zt68"
}