Unsafe Reflection

org.apache.calcite.avatica, avatica-core is vulnerable to unsafe reflection. The vulnerability is due to unrestricted calls to Class.forNameString during plugin instantiation, which allows an attacker to potentially trigger the execution of static initializer blocks in arbitrary classes available...

EUVD-2026-84533

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Calcite Avatica. Plugin instantiation via AvaticaUtilsinstantiatePlugin and other methods initializes arbitrary classes via unrestricted calls to Class.forNameString which by default triggers...