Apache Johnzon
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_johnzon:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Johnzon (d354d796-c263-5c7b-8345-33c2aacb523e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-71253 |
vulnerable | 2026-11-03 10:16:05.245343 |
Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.
ClassConverter loads & static-initializes an attacker-named class from untrusted JSON.
This issue affects Apache Johnzon: from 1.0.0 before 2.2.0.
Users are recommended to upgrade to version 1.3.1 (javax namespace) or 2.2.0 (jakarta specification namespace), which fixes the issue.
Published: 2026-10-19T10:36:41.781Z
Updated: 2026-10-20T19:34:25.835Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-33008 |
vulnerable | 2026-06-08 06:04:48.177982 |
Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon.
A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal.
This issue affects Apache Johnzon: through 1.2.20.
Published: 2023-07-07T09:07:31.070Z
Updated: 2024-10-07T19:13:58.440Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.