Apache Johnzon’s JSON parsing engine includes a class converter that, when encountering a class name supplied in an untrusted JSON payload, will load that class and execute its static initializer. This unsafe use of reflection is a classic example of externally controlled input selecting arbitrary classes (CWE-470). The ability to trigger static initialization allows an attacker to execute code within the context of the application without needing to upload or deploy new modules. Affected systems can lose confidentiality, integrity, and availability because executing a batch of arbitrary Java bytecode can modify data, exfiltrate information, or shut down services. The impact is severe: any component that accepts JSON from an untrusted source and uses Johnzon for deserialization is potentially vulnerable. Based on the description, the likely attack vector is any pathway that allows an attacker to supply JSON to the server – for example, HTTP request bodies, API payloads, or file uploads. No additional prerequisites such as elevated privileges are required; the vulnerability exists purely at deserialization time.

All installations of Apache Johnzon with a version prior to 2.2.0 are affected, including the 1.x series. The vendor recommends upgrading to version 1.3.1 (for the javax namespace) or to 2.2.0 (for the jakarta specification namespace). No other products outside Apache Johnzon are listed as impacted.

The CVSS score is not provided in the public data, but the vulnerability allows execution of arbitrary code with the privileges of the application process. The likely attack vector is any path that allows an attacker to supply JSON to the server, such as HTTP request bodies, API payloads, or file uploads. EPSS information is unavailable, so the exact probability of exploitation cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, indicating that no confirmed public exploits are currently known. However, because the flaw hinges on untrusted input, it remains a high‑risk exposure for applications that expose JSON endpoints or import data from untrusted sources.