Apache Johnzon
Monthly
Unsafe reflection in Apache Johnzon's ClassConverter can cause the library to load and statically initialize an attacker-named class from untrusted JSON, potentially producing code execution or other harmful side effects when a suitable classpath gadget and an exposed deserialization path exist. Signals conflict sharply and should be weighed together rather than reading the 9.8 at face value: the public CVSS is 9.8 and SSVC technical impact is total, but the assessed vector uses AC:H, EPSS is 0.36% (28th percentile), no CISA KEV entry was present, and no public exploit identified at time of analysis. The issue affects Johnzon 1.0.0 to before 1.3.1 in the javax namespace and 2.0.0 to before 2.2.0 in the jakarta namespace, with fixed releases 1.3.1 and 2.2.0.
Unsafe reflection in Apache Johnzon's ClassConverter can cause the library to load and statically initialize an attacker-named class from untrusted JSON, potentially producing code execution or other harmful side effects when a suitable classpath gadget and an exposed deserialization path exist. Signals conflict sharply and should be weighed together rather than reading the 9.8 at face value: the public CVSS is 9.8 and SSVC technical impact is total, but the assessed vector uses AC:H, EPSS is 0.36% (28th percentile), no CISA KEV entry was present, and no public exploit identified at time of analysis. The issue affects Johnzon 1.0.0 to before 1.3.1 in the javax namespace and 2.0.0 to before 2.2.0 in the jakarta namespace, with fixed releases 1.3.1 and 2.2.0.