Threats affecting pkg:maven/Apache Software Foundation/org.apache.calcite.avatica:avatica-core

CVE-2026-70410 is a vulnerability in Apache Calcite Avatica before version 1.29.0 involving unsafe reflection. The issue arises from plugin instantiation methods that allow arbitrary classes to be initialized via Class.forName(String), potentially triggering static initializer blocks. Although no known dangerous static initializers are widely used, the vulnerability could lead to unintended code execution. The vulnerability has a high severity score of 8.8. Users are advised to upgrade to version 1.29.0 where this issue is fixed.