External risk intelligence

Apache Johnzon Unsafe Reflection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-71253

Apache Johnzon is a library used for JSON processing. While it can be integrated into internet-facing web applications or APIs that deserialize untrusted JSON input, it is a backend dependency rather than a standalone service or edge gateway. Its reachability depends entirely on how the consuming application implements JSON handling, making internet exposure possible but not a default or guaranteed deployment pattern.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Apache Johnzon, a JSON processing library, could allow an attacker to execute arbitrary code. This occurs when the library processes untrusted JSON input, leading to the loading and initialization of attacker-controlled classes. The potential impact is significant, ranging from data compromise to system disruption.

Unsafe code loading from untrusted JSON input.
Critical risk if processing external JSON data.
Confirm if your applications use this library.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted JSON input to an application that uses Apache Johnzon for JSON processing. The `ClassConverter` component within Johnzon, when processing this untrusted input, will load and initialize a class specified by the attacker. This unsafe reflection mechanism can allow an attacker to execute arbitrary code within the application's context.

No authentication or user interaction needed.
Malicious JSON input triggers class loading.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to load and initialize arbitrary Java classes by providing specially crafted JSON input. When supported by the application, this could lead to the execution of malicious code on the server.

Server-side code execution is at risk.
Malicious JSON input can trigger class loading.
Compromise of system integrity and confidentiality.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that Apache Johnzon is a library, the teams responsible for addressing this vulnerability will likely be those managing the applications that utilize it. This could include application owners, development teams, and platform engineers who integrate it into their services. The immediate priority is to locate all instances of Apache Johnzon within the environment, determine their exposure, assess business criticality, and identify the accountable owners to plan remediation.

Application owners and platform teams.
Verify all Apache Johnzon instances and exposure.
Plan phased upgrades based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Johnzon?

Apache Johnzon is a Java library designed to handle JSON data processing. Developers integrate it into their applications to transform JSON into Java objects and vice versa, which is a common requirement for web services, APIs, and data-driven backend systems.

What does 'Unsafe Reflection' mean for CVE-2026-71253?

This weakness, classified as CWE-470, occurs when software allows external input to dictate which internal classes or code segments the system loads. In this case, the Johnzon library mistakenly trusts JSON data to identify and initialize classes, effectively giving an attacker a mechanism to force the application to execute code of their choosing.

How is this vulnerability triggered?

An attacker triggers the flaw by sending a specially crafted JSON payload to an application using a vulnerable version of Johnzon. The vulnerability specifically involves the ClassConverter component; simply using the library for standard, trusted data transformation does not inherently cause the issue unless the application parses attacker-controlled JSON.

Is my application at risk if it uses Apache Johnzon?

Halo Surface Signal notes that because Johnzon is a backend dependency rather than a standalone service, risk depends on how your specific application handles JSON. If your application accepts and deserializes JSON from the internet, it is at higher risk than an application that only processes JSON from internal or trusted sources.

How do I address this Apache Johnzon vulnerability?

The primary response is to update the library to a secure version. Depending on your environment, you should upgrade to version 1.3.1 if using the javax namespace, or version 2.2.0 if using the jakarta specification. Start by auditing your dependencies to identify where the library is currently integrated.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.