CVE-2026-71253

CriticalCVSS 9.8/10Last modified Oct 20, 2026

Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.

ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.

This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.

Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-470

Affected software

VendorProductVersions
Apache Software FoundationApache Johnzon>= 2.0.0, < 2.2.0; >= 1.0.0, < 1.3.1

References

Timeline

Published
Oct 19, 2026
Last modified
Oct 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-712549.8nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (FC 0x14, Read File ReCVE-2026-712558.6nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MCVE-2026-712569.8nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_identification_basic / rCVE-2026-712577.5Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUploCVE-2026-712598.6ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighCVE-2026-71267.3A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajaCVE-2026-712606.5ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_seCVE-2026-712617.8dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_prCVE-2026-712629.8IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CCVE-2026-712639.1The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). The check uses a stricCVE-2026-712648.2WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint wCVE-2026-712657.5Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-
CVE-2026-71253: Critical severity, CVSS 9.8 | Vulnix