10.0 Critical

CVE-2026-73098 Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing

Description

Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer. The impact depends on the classes present in the deployment. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

CVSS 4.0 detail

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
Interaction: None
Confidentiality: High
Integrity: High
Availability: High
Confidentiality of other systems: High
Integrity of other systems: High
Availability of other systems: High

Affected products and versions

Product	Affected versions	Fixed in
Apache Juneau 9.2	earliest → < 9.2.1	9.2.1

References

lists.apache.org lists.apache.org

Timeline

Published November 5, 2026
Last modified November 5, 2026

The 9 CVEs of Apache Juneau →

CVE-2026-121489 Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory 10.0 Critical CVE-2026-96677 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome 10.0 Critical CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data 10.0 Critical CVE-2026-73116 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects 10.0 Critical

Track this CVE