Apache Johnzon: Unsafe reflection in ClassConverter via untrusted JSON
Summary
Apache Johnzon, a Java library for JSON processing and JSON-B binding, contains an unsafe reflection flaw in its ClassConverter. An attacker can supply a class name in untrusted JSON, causing the library to load and statically initialise that class. Exploitation depends on the application binding untrusted JSON to Java types that use this library and on a suitable class being available on the classpath.
Affected
- Apache Johnzon from 1.0.0 before 1.3.1 (javax namespace)
- Apache Johnzon from 2.0.0 before 2.2.0 (jakarta namespace)
- Often pulled in transitively via org.apache.johnzon:johnzon-mapper or johnzon-jsonb
Fixed in
- Upgrade to 1.3.1 (javax namespace)
- Upgrade to 2.2.0 (jakarta namespace)
Workaround
Unknown.
Exploitation
- CISA SSVC: Exploitation none, automatable yes, technical impact total
- No known exploitation in the wild; not listed in CISA KEV at the time of research
- No credible public proof of concept found; sources conflict on this point
Our recommendation
- Inventory Java applications and check dependency trees, including transitive dependencies, for johnzon-mapper and johnzon-jsonb
- Upgrade to 1.3.1 (javax) or 2.2.0 (jakarta) as soon as possible
- Prioritise internet-facing services that accept JSON without authentication
- Where an upgrade is not immediately possible, restrict who can send JSON to affected endpoints
- Monitor the Apache mailing list, NVD and vendor advisories for final severity and any proof of concept
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record commit 91e7b0d (Apache Johnzon) github.com
- CVE record commit dd3d006 (Apache Johnzon) github.com
- Apache mailing list thread lists.apache.org
- Talend component-runtime PR 1311 (downstream upgrade) github.com
- VulDB entry CVE-2026-71253 vuldb.com
- Mend/Vulners entry CVE-2026-71253 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:27.
Original description (NVD)
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.