Apache Johnzon

Apache Johnzon Security Vulnerabilities

This page lists the security vulnerabilities fixed in released versions of Apache Johnzon. To report a new vulnerability, see Report vulnerability.

CVE-2026-71253: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON

  • Severity: Low
  • Affected: org.apache.johnzon:johnzon-mapper 1.0.0 before 1.3.1 and 2.0.0 before 2.2.0
  • Fixed in: 1.3.1 (javax namespace), 2.2.0 (jakarta namespace)
  • Credit: n0mi1k Security (finder)
  • Announcement: dev@johnzon.apache.org

Unsafe reflection: ClassConverter resolves and statically initializes a class named in untrusted JSON. Exploitation needs a mapped POJO with a Class attribute and a class with a harmful static initializer on the classpath.

CVE-2023-33008: Prevent inefficient internal conversion from BigDecimal at large scale

  • Severity: Important
  • Affected: Apache Johnzon through 1.2.20
  • Fixed in: 1.2.21
  • Credit: PJ Fanning (reporter)
  • Announcement: lists.apache.org

Denial of service: JSON input with very large numbers (e.g. 1e20000000) deserialized into BigDecimal can cause a slow conversion. Johnzon 1.2.21 limits the BigDecimal scale to 1000 by default. See also BigInteger and Java.