7 matches found
CVE-2026-71253
A flaw was found in Apache Johnzon. This vulnerability allows a remote attacker to potentially execute arbitrary code by submitting a specially crafted JSON payload. Due to unsafe class loading in the ClassConverter component, the application loads and statically initializes an attacker-specified...
CVE-2026-71253
Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...
CVE-2026-71253 Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...
EUVD-2026-104193
Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...
CVE-2026-71253 Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...
CVE-2026-71253
A vulnerability in Apache Johnzon (versions 1.0.0 to before 2.2.0) allows a remote attacker to potentially execute arbitrary code by submitting a crafted JSON payload. The root cause is unsafe reflection within the ClassConverter component, where it loads and statically initializes an attacker-sp...
PT-2026-117336
Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...