CVE-2026-71253

--- CME Mitigation Guidance (2026-10-20) ---

The highest-value action is to restrict class loading during JSON deserialization to an explicit permit-list of safe types when deserializing into java.lang.Class fields in Johnzon Mapper: upgrade to Apache Johnzon 1.3.1 or 2.2.0 (or the fixed Johnzon Mapper builds), which restrict and guard class deserialization in ClassConverter and LazyConverterMap against loading arbitrary class names, closing crafted JSON payload containing an arbitrary class name targeting a Class-typed field. Until patched, this is a concern on applications deserializing untrusted JSON payloads into object models containing java.lang.Class typed fields, so avoid deserializing untrusted JSON into object models containing java.lang.Class fields and audit the classpath to eliminate classes with dangerous static initializers or gadget chains. As a compensating measure, enforce strict permit-list validation on incoming class name strings rather than relying on denylists to prevent arbitrary class resolution. These controls limit blast radius and contain exploitation, but they do not fix the underlying unsafe dynamic class loading defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1302 Deserialization Allowlist (Safe Loading) (high)

Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.