Apache Juneau 9.2.1 fixes multiple vulnerabilities
Apache Juneau 9.2.1, released November 3, addresses multiple CVEs including CVE-2026-73095.
50
CVE-2026-73098
Dynamic class loading with init in Apache Juneau before 9.2.1
- CVSS 4.0
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Juneau parses values into java.lang.Class properties and loads named classes with static initializers enabled. This occurs when endpoints receive crafted input. Attackers gain code execution if classes on the classpath allow it. Impact depends on deployment classes present. All users of versions through 9.2.0 are potentially affected.
What to do: Upgrade Apache Juneau to 9.2.1. No workaround mentioned.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Juneau | through 9.2.0 | 9.2.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer. The impact depends on the classes present in the deployment. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
- Weakness
- CWE-470
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X