Vulnerabilidades do Apache Software Foundation Apache Johnzon
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Apache Software Foundation Apache Johnzon: 1 registro(s), com versões afetadas e correções.
CVE-2026-71253
Crítica · 9.8
CWE-470 19/10/2026
Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.
ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.
This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.
Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.