Loading vulnerability…
Unsafe Class Initialization in Apache Juneau
CVE-2026-73098 is an unsafe-reflection vulnerability in Apache Juneau's juneau-marshall module through version 9.2.0. When parsing a value into a java.lang.Class property, including parameterized forms, the default class swap loads the input-named class with initialization enabled. An attacker-controlled value naming a class on the application's classpath can therefore trigger that class's static initializer. The security consequences depend on the classes available in the deployment and their initializer behavior.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attacker-selected classes already available on the application classpath can have their static initializers executed during parsing, causing unintended behavior within the application process. Specific confidentiality, integrity, and availability consequences depend on those initializers. Execution of arbitrary attacker-supplied code is not established.
If you can’t patch tonight, do this now.
Until upgrading, prevent untrusted input from being parsed into bean properties of type java.lang.Class, including parameterized forms.
Patch, then assume compromise.
Upgrade Apache Juneau to version 9.2.1, which loads parsed classes without initialization. Upgrade the affected juneau-marshall dependency and any shaded or aggregate artifacts embedding the vulnerable module.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.