Apache Johnzon’s JSON parsing engine includes a class converter that, when encountering a class name supplied in an untrusted JSON payload, will load that class and execute its static initializer. This unsafe use of reflection is a classic example of externally controlled input selecting arbitrary classes (CWE-470). The ability to trigger static initialization allows an attacker to execute code within the context of the application without needing to upload or deploy new modules. Affected systems can lose confidentiality, integrity, and availability because executing a batch of arbitrary Java bytecode can modify data, exfiltrate information, or shut down services. The impact is severe: any component that accepts JSON from an untrusted source and uses Johnzon for deserialization is potentially vulnerable.

All installations of Apache Johnzon with a version prior to 2.2.0 are affected, including the 1.x series. The vendor recommends upgrading to version 1.3.1 (for the javax namespace) or to 2.2.0 (for the jakarta specification namespace). No other products outside Apache Johnzon are listed as impacted.

The CVSS score is 9.8, indicating a critical severity, but the vulnerability allows execution of arbitrary code with the privileges of the application process. The likely attack vector is any path that allows an attacker to supply JSON to the server, such as HTTP request bodies, API payloads, or file uploads. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating that no confirmed public exploits are currently known. However, because the flaw hinges on untrusted input, it remains a high‑risk exposure for applications that expose JSON endpoints or import data from untrusted sources.