CVE-2026-73098Critical· 10.0▾ MidnightImproper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with in…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 55 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Improper control of dynamically-loaded code vulnerability in Apache Juneau.
When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer. The impact depends on the classes present in the deployment.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
org.apache.juneau:juneau-marshall < 9.2.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73095High· 8.7Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
CVE-2026-96677Critical· 10.0Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
CVE-2026-82894NoneApache OFBiz: Content renderer runs a service name stored on the row
CVE-2026-71253Critical· 9.8Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
CVE-2026-70410High· 8.8Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica
CVE-2026-41871Critical· 9.8Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)