---
id: CVE-2026-71253
title: >-
  Apache Johnzon: ClassConverter loads & static-initializes an attacker-named
  class from untrusted JSON
summary: >-
  Use of Externally-Controlled Input to Select Classes or Code ('Unsafe
  Reflection') vulnerability in Apache Johnzon.




  ClassConverter loads & static-initializes an attacker-named class from
  untrusted JSON.





  This issue affects Apache J…
severity: none
cwe:
  - CWE-470
vendor: Apache Software Foundation
product: 'org.apache.johnzon:johnzon-mapper'
affected:
  - 'org.apache.johnzon:johnzon-mapper >= 2.0.0 < 2.2.0'
  - 'org.apache.johnzon:johnzon-mapper >= 1.0.0 < 1.3.1'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T10:36:41.781Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-71253'
references:
  - url: >-
      https://github.com/apache/johnzon/commit/dd3d00634c746a2173a2518e882e85e8a151bf30
  - url: >-
      https://github.com/apache/johnzon/commit/91e7b0d21d08d138944e2570691939739422a3d6
  - url: 'https://lists.apache.org/thread.html/3vgm1yo2sn9yhkvvs9lc4ro01vl3zt68'
tags:
  - cve.org
ingestedAt: '2026-10-19T12:27:23.813Z'
---

## Overview

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.



ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.




This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.



Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.

## Affected

- `org.apache.johnzon:johnzon-mapper >= 2.0.0 < 2.2.0`
- `org.apache.johnzon:johnzon-mapper >= 1.0.0 < 1.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.