Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. (CVE-2026-71253)

CVE-2026-71253 is an unsafe reflection vulnerability in Apache Johnzon where the ClassConverter component loads and static-initializes a class specified by attacker-controlled JSON input. This allows an attacker to influence class loading and execution, potentially leading to remote code execution or other severe impacts. The vulnerability affects all versions starting from 1.0.0 up to but excluding 2.2.0. The vendor has fixed the issue in version 1.3.1 for the javax namespace and 2.2.0 for the jakarta namespace.

Successful exploitation can result in full compromise of confidentiality, integrity, and availability of the affected system, as indicated by the CVSS score of 9.8 with network attack vector, no privileges required, and no user interaction needed. This means an unauthenticated remote attacker can execute arbitrary code or cause denial of service by supplying malicious JSON input that triggers unsafe reflection.

Users should upgrade Apache Johnzon to version 1.3.1 if using the javax namespace or to version 2.2.0 if using the jakarta specification namespace. These versions contain the official fix for this vulnerability. No other mitigations are specified by the vendor advisory.