{"id":"CVE-2026-73098","aliases":[],"cve":{"records":[{"id":"CVE-2026-73098","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-10T20:21:04.070Z","published":"2026-11-05T11:49:18.771Z","modified":"2026-11-05T19:04:12.529Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-05T11:49:18.771Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-05T19:04:12.529Z"}],"references":[{"url":"https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-470","description":"CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')","source":"apache"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-05T16:58:46.303904Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing","titleSource":"apache","descriptionSource":"apache","description":"Improper control of dynamically-loaded code vulnerability in Apache Juneau.\n\nWhen Apache Juneau parses a value into a property of type java.lang.Class (including parameterized forms), the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer. The impact depends on the classes present in the deployment.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue.","score":10,"severity":"critical","published":"2026-11-05T11:49:18.771Z","modified":"2026-11-05T19:04:12.529Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Juneau","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"9.2.1","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.juneau/juneau-marshall","packageIdentity":{"ecosystem":"Maven","name":"org.apache.juneau:juneau-marshall"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-73098"}],"remediation":[],"references":["https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6"],"sources":[{"name":"CVE","id":"CVE-2026-73098","modified":"2026-11-05T19:04:12.529Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-73098"}],"assessments":[{"source":"apache","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":10}],"sourceAffected":[],"observedAt":"2026-11-05T19:49:55.942Z","kev":{"status":"not-listed","checkedAt":"2026-11-07T23:00:33.112Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-05T13:05:32.664Z","attemptedAt":"2026-11-05T13:05:32.664Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-05T13:05:33.006Z","attemptedAt":"2026-11-05T13:05:33.006Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-05T13:05:32.859Z","attemptedAt":"2026-11-05T13:05:32.859Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-05T13:05:32.421Z","attemptedAt":"2026-11-05T13:05:32.421Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-73098","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73098","modified":"2026-11-05T12:17:50.770","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-05T13:05:32.664Z"},{"source":"ENISA EUVD","id":"EUVD-2026-117407","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117407","modified":"Nov 5, 2026, 11:49:18 AM","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","checkedAt":"2026-11-05T13:05:32.859Z"},{"source":"GitHub Advisory Database","id":"GHSA-59fg-f5xc-xjg9","url":"https://github.com/advisories/GHSA-59fg-f5xc-xjg9","modified":"2026-11-05T12:32:20Z","checkedAt":"2026-11-05T13:05:33.006Z"}],"aiSummary":{"text":"Apache Juneau through 9.2.0 has an unsafe reflection vulnerability, allowing an attacker to control class initialization during parsing. The impact depends on the classes present in the deployment. An attacker can exploit this with access to the application classpath.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-05T12:51:04.150Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-73098"}]}}