CVE-2026-71253: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') in Apache Software Foundation Apache Johnzon

The vulnerability in Apache Johnzon is a CWE-470 'Use of Externally-Controlled Input to Select Classes or Code' issue, also known as unsafe reflection. Specifically, the ClassConverter component loads and static-initializes a class named by attacker-controlled input from untrusted JSON data. This can lead to unsafe execution of arbitrary classes. The affected versions are >=1.0.0 <1.3.1 (javax namespace) and >=2.0.0 <2.2.0 (jakarta namespace). The vendor recommends upgrading to 1.3.1 or 2.2.0 to remediate the issue.

An attacker can supply malicious JSON input that controls which class is loaded and initialized by the ClassConverter, potentially leading to arbitrary code execution or other unsafe behaviors depending on the loaded class. This undermines the security assumptions of the application using Apache Johnzon.

Users should upgrade Apache Johnzon to version 1.3.1 (javax namespace) or 2.2.0 (jakarta namespace), which contain fixes for this unsafe reflection vulnerability. No other mitigation is indicated by the vendor advisory.