CVE-2026-71253

About vulnerability

Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerability in Apache Johnzon.

ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.

This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.

Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.

Affected product:

Spring , artemis , camel , johnzon

Affected packages:

artemis-jakarta-client @ 2.37.0 (+1466 more)